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Reactance Tube Modulation of Phase: Shift Oscillators 
By F. R. DENNIS and E. P. FELCH 


This paper describes a basic circuit for reactance tube modulation of phase 
shift oscillators. The design of suitable phase shift oscillators for frequencies from 
audio through the ultra-high frequencies is discussed. Experimental performance 
data derived from several types of frequency modulated phase shift oscillators 
are presented, 


INTRODUCTION 
REQUENCY modulation of oscillators is finding wide-spread use in 
such diverse fields as FM_ broadcasting, telemetering systems for 
led missiles and measuring apparatus for observing transmission fre- 


quency characteristics on cathode ray tubes. Design objectives for such 


oscillators may be listed brietly as: 


1. A wide range of frequency modulation or, alternatively, high modula- 
tion sensitivity. 

2. A linear relationship between instantaneous values of modulation 
input voltage and frequency deviation. 

3. Freedom from accompanying amplitude modulation. 

4, Inherent center frequency stability. 

5. Ease and stability of adjustment. 

6. A minimum number of components, none of which should be critical. 

7. Modulation by dc, audio, or video inputs. 

8. Operation anywhere in the frequency spectrum from low audio fre- 


quencies through the ultra-high frequency region. 


‘he circuits described in this paper were developed in the course of an 


investigation of various frequency modulation circuits for use in visual trans- 


mission measuring systems. The oscillators had to be capable of linear modu- 


lation at 60 cycles over a +3 megacycle band at 25 megacycles and over a 


+9 
the 


megacycle band at 80 megacycles. Existing designs fell short of meeting 
requirements with respect to several of the characteristics listed above. 


The reactance tube modulated phase shift oscillator circuit was found to 


perform. satisfactorily in the transmission set and proved superior in many 


respects to all the other circuits tried. Tests of the circuit at other frequencies 


disc 


the 


losed that the advantages were not peculiar to the frequency range and 


following description is presented with the expectation that it may 


prove useful to others. 
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Fig. 1—Simplified schematic of conventional reactance tube modulated oscillator. 
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Fig. 2—Simplified schematic of phase shift reactance tube modulated oscillator. 
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Fig. 3—Direction of frequency deviation for increasing Gy of reactance tube. 
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Fig. 4—LC reactance tube modulated phase shift oscillator. 
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Fig. 5—RC reactance tube modulated phase shift oscillator. 


CirRcUIT DESCRIPTION 
The theory and design of conventional reactance tube modulated oscil- 
lators has been discussed adequately in the literature'’*. A schematic in 


1“Frequency Modulation” (book) by August Hund—McGraw-Hill, New York, 1942. 
Page 155. as ror . 

2“Automatic Tuning, Simplified Circuits and Design Practice,’ D. E. Foster, and 
S. W. Seeley. Proc. 1. R. E., Vol. 25, 1937, page 289. 

3 ATC Systems—-Wireless World, February 19, 1937, page 177. 








604 BELL SYSTEM TECHNICAL JOURNAL 


a . _ oa cee, ] 
Ail Fez, 
Vu 5 








| 4 | \ 
| OSCILLATOR () ry REAC TANCE 
| TUBE | 4 TUBE 
5 | 4) rs 
/ 4 yo 4 / \ 
\ sa iia, «cits ( 4 3 : ~} {¢ eee Ds, asi 4 
1 | \ 
new 4 P ee: | \ — 
* sa. | TPA . 
4 | | Y 4 | — 
| S, | 4 Ww GH S | 
| | | ' 


MOD 
i {(--—9— \/\/* paeeante a INPUT 
| 
| a 
} 50 WHERE 
= ro) Fo= (MEGACYCLES) K =DIELECTRIC CONSTANT 
+B lalla L= LENGTH OF LINE IN 
ME TERS 


Fig. 6—Transmission line reactance tube modulated oscillator. 
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Fig. 7-—-Performance curves of typical LC reactance tube modulated phase shift 
oscillator 


simplified form is shown in Fig. 1. The input and output of a vacuum 
tube amplifier are connected together by a tuned circuit and feedback 


network which introduces 180° phase shift at the undeviated frequency Fo. 
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Fig. 8 Performance curves of typical RC reactance tube modulated phase shiit 


oscillator. 
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Fig. 9—Performance curves of typical transmission line reactance tube modulated 
oscillator. 
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An auxiliary path contains the reactance tube fed from a 90° phase shift 
network connected as shown. The direction of frequency deviation is deter- 
mined by the sign of the 90° phase shift. The amount of the deviation is 








Fig. 10-——Construction of transmission line reactance tube modulated oscillator. 


(a) Tube side. (b) Line side. 


determined by the transconductance variation of the reactance tube, by 
the impedance across which the reactance tube is connected and by the 
loss in the 90° phase shift network. The linearity is a function of all of these 
factors. In general the frequency deviation may be increased by increasing 
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the Z/C ratio in the oscillator tuned circuit, but only at the expense of 
frequency stability. 

A simplified schematic of the reactance tube modulated phase shift 
oscillator is shown in Fig. 2. The mathematical theory of operation is anal- 
ogous to that of the conventional! reactance tube modulated oscillator, and 
the same methods of analysis may be applied. The 90° phase shift network 
required in the reactance tube grid circuit is a portion of the feedback net- 
work and provides half of the 180° phase shift required for oscillation. In 
this circuit the reactance tube is tightly coupled into the oscillating circuit 
with minimum loss in the 90° phase shift network. Hence small values of 
LC ratio may be employed with a consequent increase in the inherent fre- 
quency stability. In practice, oscillators comparable in stability to good 
nonmodulated oscillators may be realized. The direction of deviation is 
determined by whether the phase of the reactance tube grid voltage leads or 
lags the reactance tube plate current. The permutations of connections and 
signs of the 90° phase shift networks are shown on Fig. 3 with the correspond- 
ing directions of frequency deviation. 

The phase shift networks need not be of the LC lumped constant variety. 
For example, RC networks or sections of transmission line may be employed 
to particular advantage at the lower and higher frequencies respectively. 
A few of the many possible circuit configurations are shown in Figs. 4, 5, 6. 


EXPERIMENTAL DATA 

Frequency deviation and output variation curves for some typical oscil- 
lators are shown in Figs. 7, 8, and 9. 

The oscillator of Fig. 9 which was built by Mr. D. Leed, is shown in 
Fig. 10. The transmission line is a section of RG59U cable with the shield 
removed, encased in a copper tube with a slot for bringing out the center 
tap of the line to the reactance tube grid. The tubes are 6J6’s with both 
sections connected in parallel. 

CONCLUSION 

Frequency modulated phase shift oscillators of several types have been 
described. These offer interesting possibilities for applications over a wide 
range of frequencies wherever stable, simple frequency modulated oscillators 
are required. With respect to range, linearity, and freedom from amplitude 
modulation their performance, as shown, is superior to that of conventional 
circuits and is at least equal to that of the.complex circuits employed in the 
most critical applications. 





A Broad-Band Microwave Noise Source } 
By W. W. MUMFORD 


Measurements of the microwave noise power available from gaseous discharges, 
such as in an ordinary fluorescent lamp, show remarkable uniformity and sta 
b&ity. Such tubes are therefore suitable for a new type of standard noise source, 


INTRODUCTION 


A STANDARD noise source, such as a hot resistance or a temperature 
limited diode, has been used advantageously for making measurements 
of the noise figure of radio receivers in the short-wave and the ultra-short 
wave region. The use of such a tool eliminates the possible errors which are 
practically inescapable when using the large amounts of attenuation which 
are needed for the determination of the ratio of power levels encountered 
in measuring noise figures with a standard signal generator. For example, 
the power from a standard signal generator might be measurable and known 
accurately at a level of 40 db below a watt, whereas the noise power avail- 
able from a resistance might be 141 db below one watt.' It is difficult to 
ascertain accurately power ratios of this magnitude, 10!°. 

Another advantage of using a standard noise source arises from the fact 
that ordinarily the bandwidth of the receiver need not be considered, thereby 
eliminating a time consuming measurement. This assumes, of course, that 
the bandwidth of the noise source is much greater than that of the amplifier 
under test. 

In the microwave region it is possible to match a resistive element to the 
waveguide over a wide enough band, but ordinary resistive materials will 
not stand the high temperatures (5000 degrees or more) needed to measure 
the noise figures encountered in practice. The noise diode is capable of furn- 
ishing adequate noise power, but one with wide bandwidth has yet to be 
developed. A good, stable, broadband microwave noise generator is needed. 

Another possible source of noise power consists of a gaseous discharge.” 
Before we examine the data which have led us to conclude that the gaseous 
discharge is a good, broad-band, stable microwave noise generator and pos- 
sibly a calculable noise standard, we review our definitions of noise figure 

1'This figure, 141 db below one watt, assumes that the effective bandwidth is 2 m¢ 
rhe resistance noise power available from a generator at 290° Kelvin is 204 db below one 
watt per cycle. 

2G. C. Southworth, Journal of the Franklin Institute, Vol. 239, *14, pp. 285-298, 
April 1945. 
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and gain,® and discuss the factors involved in making noise figure measure- 
ments by means of a noise source. 


NOTES ON NOISE FIGURI 


Definition: The Notse Ficure of a network, with a generator connected 
to its input terminals, is the ratio of the available signal-to-noise power ratio 
at the signal generator terminals (weighted by the network bandwidth) 
to the available signal-to-noise power ratio at its output terminals. 

Definition: The Gats of a network is the ratio of the available signal 
power at the output terminals of the network to the available signal power 
at the output terminals of the signal generator. 


INPUT OUTPUT 
TERMINALS TERMINALS 
| 


; 1 4 
aaa a 2 = 
s 


en = 4kT;RiB 


> POWER 


| NETWORK | OUTPUT 
<— < @\ METER 
es \) | | 
GENERATOR 
TERMINALS GAIN =G 


NOISE FIGURE = F 


Fig. 1—Schematic diagram of generator, network and output power meter. 


These detinitions apply to a circuit consisting of a generator, a network 
and an output power meter as shown schematically in Fig. 1. The signal 
power available from the generator, having an open circuit voltage e and 
an internal resistance R; , is: 


e 
Ps — { | ) 
SA 4R, 


The noise power available from the signal generator resistance, R; , at ab- 
solute temperature 7; , is 
' 4K7T,R\B ,..,, , 
Pya = - —— if Mey > ()) 
4R, 
where B is the effective bandwidth of the network, by which the generator 


noise is weighted in this case. 


3H. T. Friis, Proc. 1. R. E., Vol. 32, #17, pp. 419-422, July, 19-4. 
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The weighted available signal-to-noise ratio at the generator terminals is: 


2 
Pss — 4R, (3) 
Py AT\b 
The network amplifies (or attenuates) the generator’s signal power by 
the factor G, the gain of the network, so that the available signal power at 
the output terminals of the network is: 


2 — 4 € 
Pso = G IR, (4) 
The network amplifies (or attenuates) the generator noise power by the 
same factor G, and also delivers noise power which originates within itself, 
Vy, so that the total available noise power at the output terminals of the 
network is: 
Pyo = GRT\B + Ny (3) 


The available signal-to-noise ratio at the output terminals of the network 
is then: 
ee 
Psp _ "HR, (6) 
Pyo GkT\B + Ny 

We now express the noise figure of the network, /, which by detinition is 
the ratio of equation (3) to equation (6), thus, 

i GkT,|B + Ny 2 
~ “Cie “) 

We should pause at this point to consider this equation further, for it 
leads us to a simpler definition of noise figure. 

Definition: The noise figure of a network is the ratio of the noise power 
output of that network to the noise power output which would exist if the 
network were noiseless. The temperature of the signal generator resistance 
is 290 degrees Kelvin. 

The choice of generator temperature of 290 degrees is an arbitrary one, 
which makes kT, = 4(10)-*! watts per cycle bandwidth; —10 log kT, = 
204 db below one watt per cycle. Putting 7, = 290 in equation (7) gives: 

Gk 290 B+ Ny 


De & 
Gk 200 B 8) 


Rearranging (8) we have: 


Ny = (F — 1)GR 290 B (9) 
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Equation (9) will now be used to illustrate one method of measuring noise 
figures. In this method, the network output noise power is measured for two 
known values of the temperature of the generator resistance, 7, and 7). 
When the generator is hot, the output noise power is, by equation (5): 


Pyon = GkRT.B + Ny (10) 
When the generator is cool, the output noise power is: 
Proc = GRT\B + Nyx (11) 
Calling the ratio of these two noise powers V: 


ei P yon 


Y = e, GRToB a Ny 


s ) 
Pyoc GkT:B + Ny (12) 


Substituting for Vy the value given in equation (9), we have for the 


T> of Ty, 
_- - 1) 7 ee "9 1) (13) 


Y-—1 


noise figure: 


In practice 7, is often near enough to 290 degrees so that the second 
term in the numerator of equation (13) is negligible. Setting 7, equal to 290 
degrees, equation (13) becomes: 

T: 
200 

F=~- (14) 
Y-1 

The determination of noise figure by this method is independent of the 
gain of the network, the degree of mismatch and the bandwidth, provided 
that the band of the noise source is broad compared with the overall RF 
band of the network and the output power meter. 


THE NOISE SOURCE 


The limitations at microwaves of a noise source such as a heated wire will 
now be discussed. In particular we are interested in measuring amplifiers 
which have noise figures between 10 and 100 (10 db to 20 db) and band- 
widths up to 200 me. If a hot wire could be matched to the impedance of a 
waveguide over a wide enough band, and raised to a temperature of 10 K 290 
degrees our VY factor would be (rearranging eq. 14): 

T 
290 


ee oa (15) 
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and setting 7, = 2900 degrees Kelvin 


Vy 


1.9 for F = 10 


ig 1.09 for F = 100 


II 


Assuming that V can be read to within +19 @ our accuracy in determining 
I would be within about +1°% for F = 10 but only within about +10% 
for F = 100. If the noise source had a temperature of 40 X 290 degrees, our 
experimental errors would be reduced accordingly to about +1/4°% for 
IF = 10 and 42.5% for F = 100. Since metal wires will not stand such tem- 
peratures, we must look to something different for the noise source if these 
accuracies are to be achieved. 

In view of the foregoing considerations, the nonoscillating reflex klystron 
presented one possibility of a suitable microwave noise source. This, how- 
ever, was not exploited because the bandwidth was not wide enough. 

Another possibility was found to be an electrical gas discharge. This type 
of source was determined to generate noise at microwave lengths when the 
open end of the input-waveguide of a sensitive microwave receiver was 
directed toward various gaseous discharge tubes, including a 721A TR 
tube containing water vapor and hydrogen, a neon light in a stroboscope, 
a mercury vapor rectifier and an ordinary fluorescent desk lamp. Of these, 
the commercial tluorescent lamp appeared to lend itself most readily to 
mounting in a waveguide without the complication of the effects of the 
internal metal electrodes, so further tests were performed on it. 


MICROWAVE MEASUREMENTS 


A T-5, 6-watt, daylight fluorescent lamp,‘ lighted from a d-c. source, 
was mounted with its axis parallel to the magnetic vector in a waveguide 
as illustrated in Fig. 2. The lamp itself was 9” long, with cathodes at each 
end. These could be isolated from the tield in the 1” x 2” waveguide by 
enclosing the portion of the lamp which extended beyond the walls of the 
waveguide in cylindrical metal shields which formed waveguides beyond 
cutoff. Thus, energy was kept from reaching the cathodes, and the noise 
source was effectively contined to that part of the discharge which appeared 
inside the main waveguide. A piston in back of the gaseous discharge tube 
served to tune out the susceptance and a trimming screw provided an 
additional adjustment. The conductance could be adjusted by varying 
the direct current. 

The admittance of the combination could be adjusted for an impedance 

4 A commercial fluorescent lamp contains about two mm. of argon and six to ten microns 


of mercury gas. The argon merely facilitates the initiation of the discharge; the mercury 
furnishes the radiation which excites the fluorescent material, 
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match at any operating frequency from 3700 mc to 4500 mc. The admittance 
diagram when the circuit was adjusted for match at 3960 me is shown in 
lig. 3; the standing wave ratio was less than 2.9 db from 3700 to 4240 me. 

At 3960 me the conductance of the gaseous discharge varied directly with 
the direct current, while the negative susceptance had a broad maximum of 
—j.62 Yo mhos at a current of 65 to 100 milliamperes, as shown in Fig. 4. 
These values are for the gaseous discharge; the susceptances of the enclosing 
glass tubing, the back piston and the holes in the sidewalls have been sub- 
tracted from the measured results. It is interesting to note that the discharge 
appears to be inductive. 

The waveguide circuit containing the gaseous discharge tube was con- 
nected to the input waveguide of a sensitive microwave receiver which was 
used as a relative noise power meter. The noise power available from the 
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Fig. 2--Waveguide circuit for microwave noise generator using a gaseous dischargs 
tube. 


gaseous discharge was substantially independent of the direct current from 
r 
10 ma to 140 ma. These data are plotted in Fig. 5, which gives 1Olog( i 1 


versus direct current in milliamperes. The ordinate has been chosen so as 
to conform with absolute measurements made subsequently. The r.m.s. 
deviation from the straight line which represents a probable coefficient of 
only —.003 db per milliampere was about +.05 db. We do not claim to be 
able to achieve even this degree of accuracy with our present measuring 
equipment and hence do not place much contidence in the numerical value 
of this coefficient. Actually the decrease in noise with increasing current 
may have been associated with a change in the ambient temperature rather 
than with the increased current density. At least it is in the right direction 
for this to be the case. 

The temperature coeflicient of the noise from the discharge was found to 
be negative; when a piece of dry ice was held on the tubular shield of the 
circuit for a few minutes (long enough for frost to form on the brass) the 
output noise power of the discharge increased 0.6 db. The circuit was heated 
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on a hot plate and allowed to return to room temperature gradually, then 
cooled with an air stream and allowed to warm up gradually while the output 
noise and the temperature of the waveguide were being recorded. This re- 
vealed the temperature coethicient of —.055 db per degree centigrade. The 
data (plotted in Fig. 6) show an r.m.s. deviation of +.114 db from this 
coefficient. 
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Fig. 3-—Admittance diagram of microwave noise generator. 


The ambient temperature of the waveguide circuit had very little effect 
on the admittance of the gaseous discharge. 

As a check on variability with respect to time, two of these noise sources 
were compared, one against the other, at five-minute intervals for 65 min- 
utes. During this time the waveguide temperature of source *1 rose from 
34° to 35.2° C and that of source # 2 rose from 33.7° to 36.1°. Each compari- 
son was corrected, according to the coefficient of —.055 db per degree C 
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and the observed temperature, to a common temperature of 34° C. Assum- 
ing that the noise figure of the microwave receiver was constant, source * 1 


2.0 
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Fig. 4—Admittance of the gaseous discharge at 3960 mc as a function of the direct 
current in the discharge. 
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Fig. 5—The microwave noise power is practically independent of the discharge current. 


showed variations whose r.m.s. deviation was + 0.11 db, while source * 2 


had similar deviations of +.092 db. Assuming on the other hand that source 
* 1 held constant and that the microwave measuring set varied with time, 
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source ®2 displayed r.m.s. deviations of +.088 db. These variations are 
in fact comparable with the probable experimental error, and the proof that 
they actually exist at all still remains to be demonstrated. 

Of thirty-two different lamps, including 10 different types of fluorescent 
coatings such as used in the pink, red, gold, soft white, daylight, green, 
white, 4500° white, black light and blue, thirty-one® were all within +0.25 
db of each other as was also a germicidal lamp with no tluorescent coating. 
Thus it appears that the source of the microwave noise energy lies chietly 


in the gaseous discharge rather than in the fluorescent coating. 





-0.055 DB/°C + 0.114 DB 


. + r , 4 













14.6 
26 30 32 SM ZX 38 40 42 44 46 48 50 S52 54 
WAVEGUIDE TEMPERATURE IN DEGREES CENTIGRADE 





Fig. 6—The microwave noise power depends slightly upon the temperature of the 
waveguide circuit. 


If this noise is tied up with the electron temperature of the discharge, we 
should expect the noise to be flat, or “white” noise. Corroborative evidence 
of this was observed when the spectrum of the noise was examined over the 
band from 3700 to 4500 me at points 20 me apart and no irregularities were 
found. The nature of the experiment was such that frequency bands of ex- 
cessive noise power would have been observed had they been present. 
Further tests should indicate whether or not a gradual change in noise with 
frequency exists. It appears, however, unlikely that such a slope exists at 
1000 me. 

Furthermore, since the level of the noise energy is so constant with respect 
to time, reproducible from tube to tube, practically independent of the 
current and only slightly affected by the ambient temperature, we might 
expect that it is being controlled or limited by some invariant physical 
property of the atoms and ions within the gaseous discharge. If this is the 
case, an absolute measurement of the noise power might lead us to some 


5 One of the 32 lamps flickered erratically. At times its noise was } db higher than the 
average. 
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theoretical explanation which, when applied to the case in hand, would 
explain the observed results qualitatively and quantitatively, thereby es- 
tablishing a new absolute standard noise source for microwave measure 
ments. 

The microwave noise power from such a discharge tube was measured at 
3930 me in cooperation with Mr. C. F. Edwards on his calibrated measuring 


set on two different occasions, 16 days apart. The values obtained were 


ry’ 


15.86 db and 15.80 db respectively for 10 log ( 00 


temperature, 7’, in the neighborhood of 11,400 degrees Kelvin. It is believed 


that the absolute measurements are correct to within -+.25 db or better. 


1). This places the 


Having determined the temperature of this noise source, we might ask, 
“Tf we should terminate our waveguide in a black body at 11,400 degrees, 
how much microwave noise power would we get from it?” The black body 
radiates with three polarizations, only one of which is propagated along the 
waveguide, and this available power is given by Nyquist:’ 


Py = a 


ehfikT — | 


(16 


where = 6.61 (10)~* joule sec. 
k = 1.381 (10)-*8 joule/deg. 
f = frequency in cycles per sec. 
& = bandwidth in cycles per sec. 


a , or ee 
At 4000 me, LT is, for 7 = 290 degrees, 6.6 (10)~* which is so small that the 


eet 3 a eae 
~. This gives us the familiar 


kl 


denominator of (16) can be replaced by 
expression for thermal noise: 
Py, = kTB watts (17) 


In other words, thermal noise is black body radiation with but one 
polarization. 

Going one step further we might also ask the question, “Ii we should 
examine the radiation from this black body with an optical spectroscope, at 
what wavelength would we find its maximum radiated energy?” The spec- 
troscope detects radiation having three polarizations, and Planck’s radia- 
tion law applies. From Wien’s displacement law, the wavelength of maxi- 
mum radiation is given by the relation: 


An = 0.289 cm deg. (18 


6 The temperature of the waveguide was 32°C when these values were measures 
7H. Nyquist, Phys. Rev., Second Series, Vol. 32, pp. 110-113, July 1928. 
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Substituting T = 11,400 degrees, 
Ne = 2535 (10) S$ cm (19) 


This is indeed an interesting result, since the mercury vapor discharge in 
the fluorescent lamp radiates most of its energy at X = 2536.52 (10)~* cm. 
The design of the lamp was guided by the effort to accentuate the radiation 
at this wavelength, and the manufacturers state that this has been achieved 
so that no other spectral line is excited to radiate more than two percent of 
the input power.® The conversion loss from de to 2536 (10)~* cm is only 
2 or 3 db. 

The striking similarity between the black body and the mercury vapor 
discharge at these two wavelengths, 7.6 cm and 2536 (10)~% cm, suggests 
the following hypothesis: 

Hypothesis: In a gaseous discharge which is radiating light energy sub- 
stantially monochromatically at a particular wavelength, \,,, the micro- 
Wave noise energy is the same as that available from a black body which 
radiates its maximum energy at that wavelength. 

Applying this hypothesis to the case in hand, where Aw» is 2536.52 (10)~* 
cm, and using Wien’s displacement law (eq. 18) we calculate the tempera- 
ture to be 


0.289 
a al = = — 39 ° d; 
i ae = tS (21) 
T = 39.29 
290 
a 1) = 38,29 (22) 
290 
10 log (sa :) = 15.84 db (23) 


Since this calculated value is so close to the measured values of 15.8 db 
and 15.86 db, it will be assumed to be correct until proved otherwise. 


CONCLUSIONS 


A commercial fluorescent lamp is a reliable source of microwave noise 
energy. At 4000 mc its effective temperature is 11,394 degrees Kelvin which 
is convenient for measuring noise figures of 20 db or less. The noise power is 
practically independent of the fluorescent coating, the current density and 
only slightly affected by the room temperature. The lamp lends _ itself 
readily to a broad-band impedance match in the waveguide. 


*G. FE. Inman and R. N. Thayer, A. /. E. E. Transactions, Vol. 57, pp. 723-726, Dec. 
1938 











Electronic Admittances of Parallel-Plane Electron 
Tubes at 4000 Megacycles 


By SLOAN D. ROBERTSON 


This paper reports the results of some measurements of the electronic admit- 

tances of close-spaced parallel-plane diodes and ‘1553’ triodes at a frequency 

of 4060 megacycles. These results reveal that the diode admittance and the 

input short-circuit admittance of the triode depart considerably from the values 

predicted by single-velocity theory. The triode transadmittance, however, is 

only slightly lower in magnitude than the low-frequency value. 

HE high-frequency admittances of electron streams flowing between 
parallel-plane electrodes have stimulated considerable theoretical 
interest. Llewellyn'?** has given an analysis of the particular case in which 
all electrons in any plane perpendicular to the direction of flow are assumed 
to have identical velocities. In practice, this approximation gives a reason- 
ably accurate expression for electron stream admittances if the electrode 
spacing is relatively large, and if the frequency is not so high that the 
actual spread in electron velocities represents an appreciable fraction of the 
transit time. Others have treated various aspects of the general prob- 
lem#>675.91°" Theoretical consideration has also been given to the problem 
of electron flow in which the electrons possess a Maxwellian velocity dis- 
tribution" !?'3.4, There has been, however, no complete analysis of the 
microwave-frequency case which takes account of the Maxwellian velocities. 
In order to orient the present work properly with previous work let us 
consider briefly the parallel plane diode shown in Fig. 1, which shows three 
representative potential distribution curves. If only a relatively few elec- 
trons are available at the cathode, the potential distribution between elec- 
trodes will be approximately equal to the space-charge-free distribution 
indicated by curve a. If an ample supply of electrons is provided by the 
cathode and if all electrons leave the cathode with zero velocity, then the 
space charge is complete in accordance with Child’s law, and the potential 
distribution follows curve 6. If, on the other hand, the cathode is capable 
of supplying an ample supply of electrons, the electrons being emitted with 
a Maxwellian velocity distribution, the potential distribution will be rep- 
resented by a curve of the type shown by c. The cases shown by curves a 
and 6 can be treated by the Llewellyn analysis. With wide spacings and at 
lower frequencies the admittances obtained with distributions of the ¢ 
type may be approximated by the results obtained by analysis of distribu- 


tions of the 6 type. With the very close spacings encountered in the Bell 
619 
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Laboratories 1553 triode the theoretical analysis no longer represents a 
valid approximation. 

Let us consider curve c in greater detail. The fact that electrons are emitted 
with a Maxwellian velocity distribution, instead of being emitted at zero 
velocity as in the Child’s law or complete space charge case, means that more 
electrons are introduced in the space between the electrodes than can tlow 
to the anode in accordance with Child’s law. The surplus electrons depress 
the potential in front of the cathode to a value below that of the cathode. 
This potential minimum is indicated by Vm in the figure. Electrons which 
have insufficient energy to cross this barrier return to the cathode. 

In the space between the cathode and the potential minimum, electrons 
are found traveling with various velocities in both directions. Between the 


potential minimum and the anode, electrons travel in one direction only, 


CATHODE 
ANODE 








“ V, 


Fig 1—Totential distributions in a _ diode 


toward the anode, but with multiple velocities. With close spacings and 
higher frequencies the distance between the cathode and the potential 
minimum may be an appreciable part of the total cathode-anode spacing, 
with the result that the electrons returning to the cathode may absorb a 
substantial amount of power from the high-frequency field. 

This argument also appliesto the cathode-grid region of a microwave 
triode such as the 1553. In order to increase the transconductance of the 
triode, it is desirable to locate the grid as close to the cathode as possible. 
The close spacing, however, leads to a greater loss of power to the returning 
electrons, which prevents a realization of the full benetits expected from the 
reduced spacing. All of these difficulties are a result of the Maxwellian veloc- 
ity distribution of the emitted electrons. 

In view of the importance of electron stream admittances in the design 
of microwave amplifiers and of the need for a better understanding of the 
performance of the 1553, a program was initiated to investigate some of 
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these effects experimentally. It seemed best to start this work with a study 
of the electron stream admittances of simple diodes, with the object of 
extending the measurements to the triode as the work progressed. 


DIODES 


The diodes used in this work were identical in construction with the 1553 
triode, but for the substitution of a solid copper anode in place of the grid. 
In all cases the cathode-anode spacing was approximately 0.65 mil, and the 
area of the cathode was 0.164 square centimeters. With this spacing one 
would expect the potential minimum to be relatively close to the anode such 
that a considerable portion of the cathode-anode region would contain 
electrons moving in both directions. The potential distribution then would 
be something like that shown in Fig. 2. 
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Fig. 2—Electron motion in a close-spaced diode 

The method used in measuring the microwave-frequency input admit 
tances of diodes was based largely on a technique used by Mr. J. A. Morton, 
and will be described in some detail. 

In a typical amplifier, radio-frequency power is fed from a waveguide 
source to the cathode-grid input region of a 1553 triode through a waveguide- 
cavity transformer. A similar circuit can be used for measuring diode ad- 
mittances. The fundamental problem is to learn how to relate admittances 
measured with a standing wave detector located in the waveguide supply 
line to the equivalent two-terminal admittances located at the cathode- 
anode gap of the diode itself. In other words, we have to know the trans- 
formation-ratio between an admittance across the cathode-anode gap of the 
diode and the corresponding admittance which will be measured in the 
waveguide. 

Let us refer to the circuit in Fig. 3. The circuit shows an input trans- 
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mission line which, for example, may be a waveguide having a characteris- 
tic impedance Z.y, connected through an ideal transformer to an output 
line having a characteristic impedance Z,,. The output line is connected to 
the transformer at the point x,, where x, represents the gap terminals of the 
diode. Suppose for the moment that provision has been made for connect- 
ing the output line at the point in the circuit normally occupied by the 
cathode-anode planes of the diode. This can be done by means of the 
special testers shown in Fig. 4. In these testers the anode has been omitted 
and provision has been made for attaching a coaxial line across the gap 
between the cathode and anode planes. The diodes used in later tests were 
identical with the device of Fig. 4, except that the coaxial output fitting was 
replaced by a sheet copper anode. 

Referring again to Fig. 3, assume that the output line is shorted at point 
xo. If power is introduced in the input line at the left, a standing wave 
pattern in the input line will pass through a minimum at some point yo. 
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Fig. 3—Equivalent circuit of diode measuring equipment. 
If the short circuit is now moved to the right by an increment Ax, the stand- 


ing wave minimum will move by an increment Ay. The relation between 
Ax and Ay is given by the following equation: 


) oe 
: cot a ane cot — — ¢ By (1) 


where A, and \, are the respective wavelengths in the two lines (which may 
not be equal if, for example, one is a coaxial and the other is a waveguide). 
¢ is the transformation ratio of the ideal transformer, and Bo is the effective 
leakage susceptance of the tube and transformer referred to the terminals 


. 2wAy. ; ‘ . 2m: 
at xo. I is plotted as a function of on cot-cot coordinate paper, 
Ay Ar 
a straight line is obtained whose slope m is 
Loy 
m= ¢—- . (2) 
Zor 


and whose ordinate intercept p is 
p = —oBoZo, (3) 


A typical cot-cot plot is shown in Fig. 5. 
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Now, assume that the right-hand transmission line is removed and that 
the diode gap is connected at the transformer terminals x9 . The normalized 
admittance referred to the point yo on the input line can be measured by a 
simple standing wave measurement. Represent this admittance by | fae 
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Let the unknown diode admittance be represented by V,. Y, is then given 
by the following relation: 
1 


Y; am VY, 4 ° (. 
Zorm [uo + Jol » 


Hence, having determined yo , it is only necessary to measure the slope m 
and the intercept p on the cot-cot curve in order to relate V, to Y..,. The 
characteristic impedance of the output line Zo, used in obtaining the cot—cot 
plot must also be known. Since a coaxial is used for this line, its charac- 
teristic impedance is easily calculated. 

If no losses were associated with the transformer or the parts of the diode 
external to the actual cathode-anode region, such as the metal vacuum 
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envelope and certain ceramic details of the tube, the above measurements 
would give complete information regarding the circuit. Certain losses have 
been found, however. These are measured as follows: At the time when 
terminals x9 are shorted a standing wave measurement is made in the wave- 
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Fig. 5 —Typical cotangent-cotangent plot. 


guide line at the left. From this measurement and the cot-cot data it is 
possible to compute an equivalent resistance in series with the gap caused by 
Josses present in the circuit. This equivalent series resistance is given by 
Zoxzm 


Ke = SWR 


(5) 
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where SWR is the voltage standing wave ratio mentioned above. The deter- 
mination of a series loss resistance in this manner is quite analogous to 
the short-circuit test used in determining the losses in a power transformer. 

There is one other factor in the cot-cot technique which is worthy of 
mention. If, at the very beginning, the output line is terminated in Zo, 
and if the transformer is adjusted so that the input line is matched, then 
the value of m will be unity and p will equal zero. It is then unnecessary to 
take a cot-cot curve. It is, however, still necessary to locate yy by shorting 


the terminals at x. 


DiopE ADMITTANCE AT 4060 MEGACYCLES 


Klectron stream admittance measurements with diodes were made in the 
following way: A coaxial tester was installed and the circuit was adjusted 
for a slope m of about one. This coaxial tester was then removed and re- 
placed by another in order to learn whether the slope obtained with one 
tester would be the same with another, supposedly identical, tester. This 
process was repeated several times, and the slope was found to vary no more 
than about 10°7% from one tester to the other. 

The procedure was then to replace the coaxial tester with a diode and make 
admittance measurements with the assumption that the slope would be 
the same for the diode as for the tester. This assumption was believed to be 
reasonable since the structure of the diode was identical with that of the 
tester except that an anode was substituted for the coaxial output connector. 
In either case all elements that were located inside the waveguide cavity 
were presumably identical. 

Electron stream measurements were made at a frequency of 4060 mega- 
cycles with a number of diodes over a wide range of anode and heater 
voltages. In making these measurements, the radio-frequency power was 
kept at a relatively low level (0.2 milliwatt) in order that the measured 
admittances would be independent of the radio frequency voltage 

Results for several diodes are shown in Figs. 6 through 13. The various 


symbols used in the figures are detined as follows: 


Vy = heater voltage 

Ty = heater current 

Vo = anode voltage (neglecting contact potentials) 

J, = anode current in ma 

J) = anode current density in ma;cm* 

g) = low-frequency diode conductance measured with an audio fre- 


quency bridge 


g = high-frequency diode conductance measured as described above 
b = high-frequency diode susceptance 
R, = equivalent resistance in series with diode 


In computing the admittance of the electron stream it was necessary to 
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and tube losses previously discussed. The equivalent 


series resistance R, of the diode circuit was determined by biasing the tube 


negatively to the point where a further increase in bias failed to produce a 
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perceptible change in the waveguide standing wave ratio. Under such 
conditions the electrons experienced a large retarding field at the cathode 
and did not emerge an appreciable distance into the cathode-anode region. 
Any resistance measured at this time was due to the series loss and was not 
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Fig. 7—Effect of heater voltage upon diode conductance. 


produced electronically. The diode series resistances varied from about 1.3 
to 5.0 ohms with an average value around 3 ohms. 

Figure 6 shows the results of admittance measurements of a diode. As 
expected, the high-frequency conductance is considerably greater than the 
low-frequency value go . In fact g is seen to have a value of several thousand 
micromhos when the negative bias of the tube is such that no perceptible 
anode current flows. The susceptance 6 for large negative anode potentials 
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has a value of 150,000 micromhos, which agrees fairly well with the value 
computed from the geometrical capacitance. As anode current is drawn and 
a space charge condition prevails, 6 drops to a value of 125,000 micromhos. 
Theoretical considerations would predict a drop of about 40°% in the case 
of a single-velocity electron stream. This is somewhat greater than the drop 
exhibited in Fig. 6. 
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Fig. 8—-Effect of heater voltage upon g/go. 


Figures 7 and 8 show the effect of cathode temperature on go and the ratio 
¢ gy. The parameter used to represent the cathode temperature is the heater 
voltage 1, . As the heater voltage is raised the total conductance g increases. 
The ratio g go, however, decreases, particularly for low or negative anode 
voltages. This means that, with a given anode voltage, as the cathode tem- 
perature is raised, go increases more rapidly than g. If the curves of Fig. 8 
are replotted in terms of Jo rather than Vo, the ratio g/go is relatively inde- 
pendent of Vy . This is shown in Fig. 9. 


The results of measurements on another diode are shown in Fig. 10. 
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These are very similar in all respects to those of the preceding figure. It is 
probable that the cathode-anode spacings of the two diodes of Figs. 6 and 10 
were somewhat greater than the 0.65 mil for which they were designed. In 
both cases the capacitances measured at low frequency were somewhat low. 
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Fig. 9—Variation of g/go with current density and heater voltage. 

In Fig. 11, results are shown for a third diode. In this case the susceptance 
at a large negative bias is in almost exact agreement with the value to be 
expected with the intended diode spacing of 0.65 mil. It is interesting to 
observe that, with this tube, 6 drops a greater amount as the current in- 
creases. Moreover, the ratio g/go is greater than that found with earlier 
diodes. 

In Fig. 12 data are shown for a diode having a very high value of go. 
rom the standpoint of cathode activity this was the best tube that was 
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Fig. 10-—Admittance of a diode. 


tried. At maximum current the susceptance 6 dropped to 50%% of the initial 
value. The data of Fig. 12 have been replotted in Fig. 13 in terms of the 


1 i . . 
variable 126x' /AJo’, where x is the cathode-anode spacing. In the Llewellyn 
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the 
figure are the theoretical results of the Llewellyn theory, whereas the broken 


theory this variable is equal to the transit time. The solid curves in 


curves present the corresponding experimental values. In the latter it should 
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be understood that the abscissa do not represent transit time. The curves 


do serve, however, to compare the theoretical diode resulting from a single- 
valued electron velocity assumption with the actual diode in which a Max- 
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wellian velocity distribution prevails. In the experimental case it is prob- 
able that, for values of the abscissa greater than 6 or 7, the actual transit 
time is considerably greater than in the theoretical case. In fact, at a value 
of 11.4 the anode voltage was zero, the anode current being maintained by 
the thermal energy of the electrons. 
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Fig. 13-—-Comparison of theoretical and experimental values of diode conductance 
and susceptance 


Other diodes were tested, but they exhibited results substantially equiva- 
lent to those already disclosed. In a few cases anomalous results were ob- 
tained. With some diodes the capacitance with no electron flow did not 
approach the low-frequency value. These were rejected on the assumption 
that there was some mechanical imperfection in the tube which changed the 
calibration of the measuring equipment. 
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With the realization that sufficient data are not available to define the 
phenomena in all detail, it is believed that certain general conclusions can 
be drawn. From the present work and that of Lavoo"® and others'7*!%, it is 
apparent that the microwave conductance of a close-spaced diode is sub- 
stantially greater than the low-frequency value. The ratio g/go appears to 
increase as the spacing decreases. This increase will probably continue until 
the position of the potential minimum approaches the anode plane. The 
susceptance decreases with increasing current and appears to level off at 
high-current densities. The tinal value at a current density of 240 ma/cm? 
varied between 0.5 and 0.9 of the initial value. 

For a given current density, the ratio g/go does not appear to vary ap- 
preciably as the cathode temperature is changed. 

An attempt was made to study the available diodes at 10,000 megacycles. 
It was found, however, that the value of R, was so high at this frequency and 
that variations in tube conductance were so small in comparison with R, 
that accurate results could not be obtained. 





Fig. 14—-Equivalent circuit of a triode, 


FOUR-POLE ADMITTANCES OF A TRIODE 


\ triode may be considered as an active linear four-pole transducer, and 
may be detined by the network of Fig. 14. It is apparent that 

vir is the input admittance with the output shorted, 

yoo Is the output admittance with the input shorted, 

yw is the feedback admittance with the input shorted, 

yo, is the transadmittance with the output shorted. 

The values of the parameters yi1, ¥e2, V2, and yo; to be measured at the 
grid, cathode, and anode terminals differ from the values of the y admit- 
tance coefficients given by Llewellyn and Peterson? who define yy; as the 
admittance of the diode coinciding with the cathode and the fictitious equiva- 
lent grid plane, and yoo as the admittance between the equivalent grid plane 
and the anode, and finally yo; as the transadmittance between the two. The 
relations between the y admittance coetficients of Llewellyn and Peterson 
and the coefficients measured by the author are given by Peterson.® It 
turns out that, with a high-mu tube, such as the 1553 triode, the two sets of 
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coefficients differ in the order of 10-20°% over the useful operating range of 
current densities; so, for practical considerations, the measure coefficients 
may be regarded as substantially equivalent to the coefficients referred to 
the fictitious grid plane. Not that they will be equal to the theoretical values, 
but they may be regarded as being associated with the same geometry and 
will serve at least as a qualitative test of the validity of the theoretical values 
for the physical tube. 

In order to measure the four-pole parameters, the 1553 triode was mounted 
in a coaxial circuit of the type shown in Fig. 15. The grid-anode output 
circuit of the tube is seen to connect directly with the coaxial output line. 
The input circuit required a more careful design. Due to the size of the base 
of the tube it was necessary to taper the input coaxial as shown. In the early 
stages of this work, difficulty was experienced with higher order modes in 
the large diameter section of the input coaxial. It was believed that these 
modes were generated by the action of the parallel wire grid which lacked the 


CATHODE ~ ANODE 


\ 






INPUT LINE  - 
———Se = ee 


\ OUTPUT LINE 
SS ASSSSSSS) _ —— an 

















Fig. 15—Detail of coaxial mount for measuring four-pole admittances of a triode. 


radial symmetry appropriate to coaxial transmission. The dithculty was 
overcome by constricting the outer diameter of the coaxial line in the im- 
mediate vicinity of the grid of the tube, thus inhibiting generation of the 
higher order mode. 

Before measurements could be made it was necessary first to calibrate 
both the input and the output circuits in a manner similar to that used and 
described in connection with the diode measurements. The coaxial tester 
used for calibrating the input circuit was identical with that used for the 
diode work. For the output circuit a similar tester was use. As one might 
expect, the value of the cot-cot slope of the output circuit was close to 
unity. The value actually turned out to be 0.9. In the input circuit the slope 
Was so great that it was difficult to measure, so that it was necessary to 
introduce a transformer in the coaxial input circuit to permit tuning 

The complete apparatus necessary to measure yy; and y» is shown in 
Fig. 16. This equipment, save for the details already discussed, is quite con- 
ventional in every respect. 
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In order to measure y;;, the output coaxial line was short-circuited at a 
point an integral number of half-wave-lengths from the grid-anode terminals 
of the tube. The admittance measured in the input line could then be used 
in computing yi;. To measure yx» , the procedure was reversed, the input 
line being shorted, and the corresponding admittance being measured in the 
output line. In either case the normalized line admittances were measured 
by the standard procedure of determining the standing wave ratio in the 
line and locating the position of the standing wave minimum with respect 
to the equivalent terminals of the tube. 

The transfer admittances were measured with the equipment shown in 
Fig. 17. The equipment shown here has been fully described in a recent 
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Fig. 16-—Circuit connected for measuring input short-circuit admittance of a triode. 


paper’ and will be described only brietly here. The output of a signal oscil- 
lator is divided into two portions. One portion is applied to a balanced 
modulator where it is modulated by an audio-frequency signal. The sup- 
pressed-carrier, double-sideband signal from the modulator is applied to the 
input circuit of the triode. Probes are provided for sampling the voltages 
Vi and V’pat points an integral number of half wavelengths from the input 
and output gaps of the tube respectively. The other portion of the oscillator 
power is fed through a calibrated phase shifter and is applied to a crystal 
detector in the manner of a local oscillator of a double-detection receiver. 
The signal samples at Vj and V3 are then alternately applied to the crystal 
detector where they are demodulated by the action of the homodyne carrier. 
In each case the phase shifter is adjusted so that the audio signal disappears 
in the detector output. This occurs when the phase of the homodyne carrier 
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is in quadrature with the signal sidebands. The difference in phase between 
. - *? . ly 
the ttvo adjustments of the phase shifter is equal to the phase between V , 


and V's . In measuring the transfer phase from V3 to V's the output coaxial 
line is terminated in its characteristic impedance. By reversing this pro- 
cedure it is possible, of course, to measure the ratio of V's to Vt with the 
input circuit terminated in Z). The ratio of the magnitudes of Vj and V3 
may be measured either with the equipment shown in Fig. 17 by adjusting 
the phase of the homodyne carrier to maximize the signals in each case and 
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Fig. 17——Circuit for measuring transfer phase of a triode 


comparing the levels, or by using the equipment in Fig. 16 in the conven- 
tional way. 

Figure 18 is a photograph of the triode circuit which shows the input and 
output coaxial standing-wave detectors with the triode mounted in the 
enlarged section at the center. 

As in the case of the diode it was found that, with the tube biased nega- 
tively such that no electrons could leave the immediate vicinity of the 
cathode, the input circuit exhibited an equivalent series resistance R,,. 
The latter had to be allowed for in reducing the experimental data. 
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Fig. 18 


Coaxial mount for measuring triode admittances. 
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The experimental data obtained as described above were sufficient for 


computing the four-pole parameters. The calculations necessary for the 
reduction of the data can best be understood by referring to Fig. 19. The 


various symbols used in connection with the figure are defined as follows: 


Y, = Normalized admittance measured at 1-1 with 2-2 shorted 
Y2 = Normalized admittance measured at 2-2 with 1-1 shorted 
Vi 

1 ; ; : , 
ye = Ye (measured with output line terminated in Zo) 


The above parameters represent those obtained by the measurements 
described above. 











Fig. 19 Equivalent circuit of triode and associated measuring equipment 


In calibrating the circuit the following parameters were obtained: 


p, = ordinate intercept of input cot—cot curve 
p. = ordinate intercept of output cot-cot curve 
i m, = slope of input cot-cot curve 
i Ny. = slope of output cot-cot curve 
Bu = — PL. Ban = — re 
| 60m 60M» 
7) = characteristic impedance of input and output coaxial lines. 


RK, was measured by shorting the output line, placing a large negative bias 
on the tube, and measuring the admittance of the input line. Then 


R. = 66m,Re(Y;) (6) 


where the number 66 represents the characteristic impedance of the coaxial 
line used in calibrating the input circuit, corresponding to Zoz: in Equation 4. 
Fortunately for simplicity, the series resistance in the output circuit 
was negligible. 
The computations are then as follows: 


Yr , V> se 
in = V20 - (7) 
; 60m OO 722 
? Vy L Jp1 () 


66m, — ¥ik, 66m, 
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1 = 
i V2 + jp 
600M» | ” 


In order to compute yo; , the following four-pole equations are used: 


, / 
, I, Vovyio 
‘,=--— + ; 
Mi Vil 
. I Vovie 
V1 = + — 
Mu Mn 
/ V / Vive 
2 1V21 2 1Y21 
12 = rT —F : 
Yoo V2 \ Y22 
It follows that 
m me , 
Vien > Viva 
mI 
/ | 1 
Ya LS Vor => 
Vi 


Referring to Fig. 19, one may write 
e = -_ - / > 
J 1 = | " iow (1; 5 Vovia) R, 
Combining (10) and (15) 
ey 
Vi l 
= , 
} l 1 — vik, 
/ ° - . 
yo, can be evaluated by making use of the relation 
I 


, 
/ 
Yoo Yo2 


] , / 
, 1¥21 
Vo 7 


™ - 
aS 
Dividing (17) by V, and rearranging terms 


, 
'o 


Yoo / 
Y — ly 
y21 > V; 1 = a 
> V2 Vee 
V2 : 
/ - 
where J>/V2 can be expressed as 


/ = 
V2 


2 . 7 
66027 66m 


= 1. 


where Zp 


(9) 


(10) 


(11) 


(12) 


(10) 


(17) 


(18) 


(19) 


of . . . . e 
1’, ‘V2 can be expressed in terms of Yo , 1, and m: by using the relations: 


/ 00m» 
Lo 


ad 


V2 


/ 06 my 


Vi 
V; Z, 


(20) 
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4 ‘ e yl » ‘ St tal 
Solving (20) for Vi/V2 and remembering that Vy /V2 = yo: , 


/ 


V my 
- = ¥21 : (21) 
Vo m» 


If (19) and (21) are substituted in (18), one finds 


! Yoo /ms 1 
ae (22) 
° ya VomtL 60M» Vee 
By using (14) and (16), yer can then be written as 
— Vee /m: 1 1 ‘ai 
i / ; 23 
21 4 my OOmMyz Yoo —_— Vu R. 


Several 1553 triodes were available for study. Typical experimental 
results obtained with two of them are shown in Figs. 20, 21, and 22. The 
triode used in obtaining the data of Fig. 20 had input and output spacings of 
0.65 and 12 mils, respectively. The cathode and anode diameters were 180 
mils. The grid opening was 250 mils and was wound with 0.3 mil tungsten 
wire at 1000 strands per inch. In the figures, 1, and V’, represent the d-c. 
grid and plate potentials, respectively. 

There are a number of interesting things to observe in Fig. 20. As with the 
diode, 6; for a large negative bias approaches the ‘“‘cold’’ value computed 
from the capacitance. However, as anode current is drawn, 6); drops rapidly 
to a much lower value than was the case for the diodes. The conductance gy 


o> os 


behaves somewhat like g for the diode. bx: is equal to the value computed 
from the grid-anode capacitance and is not appreciably intluenced by the 
electron stream. g»» was very low with a magnitude of slightly less than 1000 
micromhos at maximum anode current. It is not shown in the figure. The 
transadmittance y2; is worth considering. When the bias is several volts 
negative, ye: has a value of about 9000 micromhos. This is about 50 times as 
high as one would expect from a consideration of the electrostatic capacitance 
between the cathode and anode of the tube. This effect has been investigated 
more fully and is discussed in another paper.*! As the tube starts to draw 
plate current, v2: rises and reaches a maximum of about 40,000 micromhos. 
The low-frequency transconductance was measured and is plotted in the 
figure. It will be observed that the high-frequency transadmittance is only 
slightly lower than g,, . This is in agreement with the theories of Llewellyn.” 
The agreement appears reasonable when one remembers that, in the theo- 
retical analysis, the magnitude of the ratio yo1/go is relatively independent 
of the transit time in the input space. 

Figure 21 shows the results of measurements on a triode identical with 
that of Fig. 20 except that the grid consists of a mesh of 0.3 mil tungsten 
wires wound at 550 strands per inch in both directions. It will be noted 
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Fig. 20—Four-pole admittances of a triode having a parallel-wire grid. 


that yo: is much lower when this tube is biased beyond cutoff than in the pre- 
vious case. The electromagnetic coupling is therefore much less for the 
mesh grid. This has also been treated in the above reference.“ With high 
negative bias the feedback admittance yy: was substantially equal to ya; 
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but, as the current density increased, yj. tended to decrease. The feedback 


admittance was always lower for the mesh grid than for the parallel-wire 


grid. 
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The remaining parameters for the triode of Fig. 21 are very similar 
to those of Fig. 20. 

Figure 22 shows the variation of the phase of the transadmittances yor 
for the two triodes. The tigure also shows the theoretical curve of the 
Llewellyn analysis for purposes of comparison. As in the case of Fig. 13 the 
abscissa do not represent transit time for the experimental values. The 
quantity x is equal to the cathode-grid spacing. 

It is of interest to compare the triode measurements with those of the 
diode. It was expected that gi: for the triode should correspond with g for 
the diode. Within the limits of reasonable experimental accuracy this 


appears to be the case. For the triode at low frequencies go ~ gm. The triode 
| g g 
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Fig. 22—Phase of triode transadmittance. 





results indicate that the ratio gi;/gm is quite comparable in magnitude with 
the corresponding ratio g go for the diode. This was expected. The behavior 
of 6); for the triode was unexpected. It was thought that, as the grid voltage 
was varied so that the input space changed from a condition of zero space 
charge to one of maximum space charge, b;; would vary from its initial 
“cold” value to a value approaching 60°¢ of the latter. This was not so. 
In the figures one observes that it drops to a much lower value. This effect 
has not been explained from a theoretical standpoint. There are several 
qualitative interpretations, but as yet no way of determining which of them 
is correct in a quantitative sense has been found. The observed phenomenon 
could, for example, be explained by an increase in the effective series resis- 


tance of the tube caused perhaps by an increase in the resistance of the 
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cathode coating." Since the effect was not observed to such a marked degree 


in the case of the diodes, it seems probable that this is not the correct 
explanation. 

It is probable that the observed variation in 6); is a space charge effect. 
It is evident in examining the diode curves that tubes which possessed the 
higher values for gy exhibited a greater variation in 6. If maximum gy can 
be taken as a measure of the cathode activity, we can then perhaps relate 
the variation in susceptance with cathode activity and hence with the loca- 
tion of the potential minimum. A shift in the position of the potential 
minimum, however, may produce two effects. It varies the transit time of 
the electrons and changes the degree of space charge in the input space. 
Kither effect might account for the variation of 6;;. A clue to this effect 
might be discovered by making measurements on structures with different 
cathode-grid spacings. 

The following experiments were performed to determine the effect of plate 
voltage on the input admittance of the triode of Fig. 20. The plate and grid 
voltages were varied simultaneously in such a way that the sum of the direct 
currents to the grid and plate remained constant at 30 milliamperes cor- 
responding to a current density of 184 ma‘cm*. The input admittance did 
not vary from the value shown for this same current density in Fig. 20 even 
though the plate voltage was varied from 250 volts to 40 volts. In a second 
experiment the plate potential was maintained at — 90 volts with respect to 
the cathode and the grid potential was varied such that the direct grid cur- 
rent varied over a range of 0 to 10 milliamperes. Again the admittances were 
found to be equal to those of Fig. 20 for the corresponding total currents. 
These two experiments suggest that, for a given geometry, the value of 
by, is primarily a function of the total current density in the input circuit. 
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Passive Four-Pole Admittances of Microwave Triodes 
By SLOAN D. ROBERTSON 


Measurements have been made of the passive, four-pole admittances of parallel- 
plane triodes over a wide range of cathode-to-grid and grid-to-plate spacings at 
a frequency of 4060 megacycles. Results are given for a parallel wire grid and a 
cross-lateral grid. The microwave transadmittances are found to be much higher 
than the values measured at low fre.uencies 


URING the course of an experimental study of the active four-pole 

admittances' of the 1553 close-spaced triode,? a question arose as to 
whether the grid wires were introducing any appreciable inductance or 
resistance in the circuit used for measurement. It appeared necessary, 
therefore, to learn something of the passive four-pole parameters of the 
triode in order to separate the electronic from the passive admittances. It 
was generally believed that the electrostatic analyses of the passive admit- 
tances which have been successfully applied at the lower frequencies would 
no longer be valid with close-spaced structures at microwave frequencies. 
lor example, it was considered possible that the grid wires themselves might 
possess an effective inductive reactance, so that the admittances between 
the grid and cathode or between the grid and anode might not be equal to 
the values computed from the electrostatic capacitances. Moreover, it was 
thought likely that energy might be transmitted from the cathode-grid 
region to the cathode-plate region or vice versa, not only by the medium of 
the electrostatic coupling, but also by means of an electromagnetic coupling 
through the grid. The measurements to be reported below indicate that the 
first of these conjectures was false, but that the second was true. 

In view of the lack of available information on these questions in general, 
it seemed highly desirable to employ the available measuring equipment, 
not only to determine the passive parameters of a triode having electrode 
spacings corresponding with those of the 1553, but to extend the scope of 
the measurements to include a wide range of electrode spacings in order 
that the results would be of more general interest. 

Although these measurements were in principle very simple, in practice 
the mechanicai problem of achieving the desired degree of accuracy proved 
rather difficult. It was required that the cathode, grid, and anode planes be 
almost perfectly parallel and that the spacings between them be adjustable 

1S. D. Robertson, “Electronic Admittances of Parallel-Plane Electron Tubes at 4000 
Megacycles,” this issue of the B.S. T. J. 


2J. A. Morton, “A Microwave Triode for Radio Relay,” Bell Laboratories Record, 
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to specific values with a high degree of precision. In order to equal the dimen- 
sional tolerances of the 1553 it was necessary that parallelism and spacing 
be accurate to 0.1 mil. 

A schematic diagram of the apparatus is shown in Fig. 1. A flat, circular 
dise having a 250-mil diameter aperture, across which the grid was stretched, 
was mounted upon the face of the hollow micrometer screw ® 1. The latter 
was mounted so that its face was accurately parallel with the end face of 
the central conductor of the input coaxial line in the upper part of the figure. 
By means of the micrometer *1 the input spacing S$), which we shall con- 
sider as representing the cathode-grid spacing, could be adjusted. The cen- 
tral conductor of the coaxial line was insulated at d.c. from the outer con- 
ductor; hence it was possible to use an ohmmeter to indicate when the grid 
was just touching the coaxial face. The micrometer could then be backed 
away from the grid by any desired amount. The input coaxial was fitted 
with a standing wave detector in the form of a probe which could be moved 
along the line and placed at any arbitrary distance / from the grid. 

On the output side of the circuit, in the lower part of the figure, there 
was another coaxial line arranged so that its center conductor could be 
driven by micrometer * 2. The latter was insulated from the outer con- 
ductor of the coaxial by means of a condenser in order that an ohmmeter 
could be used to determine the position of the micrometer which caused the 
central conductor to just touch the grid. Spacing S». could then be adjusted. 
The output coaxial line was terminated in its characteristic impedance of 
62 ohms. At a distance of \,/ 2 from the grid a probe was located for sampling 
the power in the output line. 

The diameter of the input coaxial conductor was 180 mils at the end. In 
the figure it will be noted that at a short distance from the end the diameter 
increased to a larger diameter (250 mils). Because of the required length 
of the central conductor, it was necessary to increase its size in this way 
for mechanical rigidity. The effect of this change in cross-section was 
computed and allowed for in the final results. The output coaxial conductor 
was relatively short, so that it was possible to assign a diameter of 180 mils 
for its entire length. The 180-mil diameter was selected to correspond with 
the diameters of the cathode and anode in the 1553 triode. 

The procedure for making the measurements was as follows: With a 
particular set of spacings S; and Sy the standing wave ratio in the input 
line was measured. This ratio, together with the measurement of the posi- 
tion of a standing wave minimum, permitted the calculation of an input 
admittance VY to be made. Then with the standing wave detector probe 
placed at a distance kh = /2 from the grid, the ratio of the voltage at the 
input terminals of the triode to the voltage appearing at the output probe 
was measured both as to magnitude and phase as described in a recent 
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lig. 1—Apparatus for measuring passive admittances of triode 
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paper.’ This quantity will be called y. These measurements were sufficient 
for an evaluation of the four-pole parameters of the structure. All measure- 
ments were made at a frequency of 4069 megacycles. 

The equivalent circuit of the passive triode structure is shown in Fig. 2. 
The desired parameters are Yui, Ve, and yo. The following equations indi- 











Fig. 2—Equivalent passive circuit of a triode 
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Fig. 3—Types of grids used in the measurements. 


cate the relation between these parameters and the measured quantities 


Y andy: i 
. 62y; ; 
Yun 7a ——- ey (1) i 
: 6222 + 1 4 
20 1 ' 
V1 : 1 + ( 2 ) 
: 1 62 y-» 


where the number 62 represents the output terminating impedance. For 
all cases to be described here the second term on the right side of Equation 1 
is small in comparison with }, This is a result of the small values encountered 
for v2. To a good approximation yi; is equal to the measured input ad- 
mittance V. This was verified by observing the variation in input admittance 
as the output spacing was varied while keeping the input spacing fixed. 
Only a slight variation in admittance was observed, which indicated that 
the fractional term in Equation 1 was small in comparison with ¥. 
Suppose, then, that for a given input and output spacing S; and S», 


““\ Method of Measuring Phase at Microwave Frequencies,” S. D. Robertson, Bell 
System Technical Journal, Vol. XXVIII, No. 1, pp. 99-103, January 1949 












Y and y are known. yx can readily be determined by readjusting the input 
spacing to equal the output spacing and measuring a second admittance 
VY’. yee will be approximately equal to this value. There is, then, sufficient 


information to compute yp. 
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output admittances with spacing 


Two grids were used in this work. The first was a parallel wire grid of 0.3 
mil tungsten wire wound at 1000 turns per inch. The second was also of 0.3 
mil tungsten wound in a crisscross fashion at 550 turns per inch. Both grids 
are shown in Fig. 3. It will be noted that the cross-lateral grid has an aper- 


The values of vi; and yo were found to be almost purely capacitive and 
were the same for both types of grid. These values are shown in Fig. 4. 
Vi. and ye correspond to capacitances Cy; and Coz , which agree surprisingly 
well with the calculated capacitances between the grid and cathode, and 


grid and plate planes, respectively. Figure 5 shows the experimentally 





651 












> 






BELL SYSTEM TECHNICAL JOURNAL 


652 

















determined values of Cy; and C2: plotted as a dashed curve. The theoretical 
values (neglecting fringing capacitance) are shown by the solid curve. Since 
fringing was neglected, it is not surprising that the measured capacitances 


should exceed the calculated values by the amount shown. 
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hig 5 Comparison of theoretical and experimental values of input and output ca 


Phe magnitudes of yy» for each grid over a range of values of S; and S» 
are shown in Figs. 6 and 7. It will be noted that, for a given set of spacings 
S; and Ss, vio is much greater for the parallel wire grid than for the cross- 
lateral. This is the sort of result one would expect if v2 resulted from electro- 
magnetic coupling through the grid, since the parallel wire grid would be 
expected to offer a better transmission path than the cross-lateral grid. 
It was not practicable with the equipment used in these experiments to 
measure the values of yy» at low frequencies where yy would be determined 
by the cathode-plate capacitance. Data were available, however, for the 


low-frequency, cathode-plate capacitance of the standard, parallel-wire 
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grid, 1553 triode having input and output spacings of 0.5 and 12 mils respec- 
tively. The capacitances averaged about 0.008 wuf, which would correspond 
to a value of yi2 of 0.0002 mho at 4060 megacycles. The latter is about 50 
times lower than the measured 4060 megacycle value. Evidently, therefore, 
electromagnetic coupling plays a dominant role 

Reciprocity should give a reasonable idea of the accuracy of these meas- 
urements. Thus, for S$; = 0.001” and Sz = 0.012”, one would expect the 
same yz2 as for the case where S,; = 0.012” and Sy = 0.001”. An examination 
of the data will indicate that the reciprocal differences are of the order of 
10% in some cases. These differences may be partly the result of the change 
in line cross section encountered in going from the input to the output. 
That is to say, the two cases being compared are not quite reciprocal in 
geometry. 

Figure 8 shows the phase of yy» for the parallel wire grid. Because of the 
low transmission through the grids there was not sufficient energy to deter- 
mine the transfer phases with any very great accuracy, particularly for 
wide spacings in the case of the parallel wire grid and for all spacings in 
the case of the cross-lateral. Consequently, Fig. 8 shows only those results 
which are believed to be reasonably accurate. 

The author wishes to acknowledge the contribution of Mr. F. A. Braun 
who ably assisted in this work. 








Communication Theory of Secrecy Systems* 
By C. E. SHANNON 


1. INTRODUCTION AND SUMMARY 


HE problems of cryptography and secrecy systems furnish an interest- 
ing application of communication theory.' In this paper a theory of 
secrecy systems is developed. The approach is on a theoretical level and is 
intended to complement the treatment found in standard works on cryp- 
tography.” There, a detailed study is made of the many standard types of 
codes and ciphers, and of the ways of breaking them. We will be more con- 
cerned with the general mathematical structure and properties of secrecy 
systems. 

The treatment is limited in certain ways. First, there are three general 
types of secrecy system: (1) concealment systems, including such methods 
as invisible ink, concealing a message in an innocent text, or in a fake cover- 
ing cryptogram, or other methods in which the existence of the message is 
concealed from the enemy; (2) privacy systems, for example speech inver- 
sion, in which special equipment is required to recover the message; (3) 
“true” secrecy systems where the meaning of the message is concealed by 
cipher, code, etc., although its existence is not hidden, and the enemy is 
assumed to have any special equipment necessary to intercept and record 
the transmitted signal. We consider only the third type —concealment 
systems are primarily a psychological problem, and privacy systems a 
ter hnological one. 

Secondly, the treatment is limited to the case of discrete information, 
where the message to be enciphered consists of a sequence of discrete sym- 
bols, each chosen from a finite set. These symbols may be letters in a lan- 
guage, words of a language, amplitude levels of a “quantized” speech or video 
signal, etc., but the main emphasis and thinking has been concerned with 
the case of letters. 

The paper is divided into three parts. The main results will now be briefly 
summarized. The first part deals with the basic mathematical structure of 
secrecy systems. As in communication theory a language is considered to 

* The material in this paper appeared originally in a confidential report “A Mathe 
matical Theory of Cryptography” dated Sept. 1, 1945, which has now been declassified 

Shannon, C. E., “A Mathematical Theory of Communication,” Bell System Technical 
Journal, July 1948, p. 379; Oct. 1948, p. 623. 


2 See, for example, H. F. Gaines, “Elementary Cryptanalysis,” or M. Givierge, ‘Cours 
de Cryptographie.” 
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be represented by a stochastic process which produces a discrete sequence of 
symbols in accordance with some system of probabilities. Associated with a 
language there is a certain parameter D which we call the redundancy of 
the language. D measures, in a sense, how much a text in the language can 
be reduced in length without losing any information. As a simple example, 
since wv always follows g in English words, the « may be omitted without loss. 
Considerable reductions are possible in English due to the statistical struc- 
ture of the language, the high frequencies of certain letters or words, ete. 
Redundancy is of central importance in the study of secrecy systems. 

A secrecy system is defined abstractly as a set of transformations of one 
space (the set of possible messages) into a second space (the set of possible 
cryptograms). Each particular transformation of the set corresponds to 
enciphering with a particular key. The transformations are supposed rever- 
sible (non-singular) so that unique deciphering is possible when the key 
is known. 

Each key and therefore each transformation is assumed to have an a 
priori probability associated with it—the probability of choosing that key. 
Similarly each possible message is assumed to have an associated a priori 
probability, determined by the underlying stochastic process. These prob- 
abilities for the various keys and messages are actually the enemy crypt- 
analyst’s a priort probabilities for the choices in question, and represent his 
a priort knowledge of the situation. 

To use the system a key is first selected and sent to the receiving point. 
The choice of a key determines a particular transformation in the set 
forming the system. Then a message is selected and the particular trans- 
formation corresponding to the selected key applied to this message to 
produce a cryptogram. This cryptogram is transmitted to the receiving point 
by a channel and may be intercepted by the “enemy*.”’ At the receiving 
end the inverse of the particular transformation is applied to the cryptogram 
to recover the original message. 

If the enemy intercepts the cryptogram he can calculate from it the 
a posteriori probabilities of the various possible messages and keys which 
might have produced this cryptogram. This set of a posteriori probabilities 
constitutes his knowledge of the key and message after the interception. 
“Knowledge” is thus identified with a set of propositions having associated 
probabilities. The calculation of the a posteriori probabilities is the gen- 
eralized problem of cryptanalysis. 

As an example of these notions, in a simple substitution cipher with ran- 
dom key there are 26! transformations, corresponding to the 26! ways we 

*The word “enemy,” stemming from military applications, is commonly used in eryp 


tographic work to denote anyone who may intercept a cryptogram. 
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can substitute for 26 different letters. These are all equally likely and each 
therefore has an a priori probability 1,/26!. If this is applied to ‘‘normal 
English” the cryptanalyst being assumed to have no knowledge of the 
message source other than that it is producing English text, the a priori 
probabilities of various messages of \ letters are merely their relative 
frequencies in normal English text. 

If the enemy intercepts .V letters of cryptogram in this system his prob- 
abilities change. If V is large enough (say 50 letters) there is usually a single 
message of a posferiori probability nearly unity, while all others have a total 
probability nearly zero. Thus there is an essentially unique “solution” to 
the cryptogram. For .V smaller (say .V = 15) there will usually be many 
messages and keys of comparable probability, with no single one nearly 
unity. In this case there are multiple “solutions” to the cryptogram. 

Considering a secrecy system to be represented in this way, as a set of 
transformations cf one set of elements into another, there are two natural 
combining operations which produce a third system from two given systems. 
The first combining operation is called the product operation and cor- 
responds to enciphering the message with the first secrecy system R and 
enciphering the resulting cryptogram with the second system S, the keys for 
R and S being chosen independently. This total operation is a secrecy 
system whose transformations consist of all the products (in the usual sense 
of products of transformations) of transformations in S with transformations 
in R. The probabilities are the products of the probabilities for the two 
transformations. 


The second combining operation is “weighted addition.” 
T= pR+ 4S p+q=1 


It corresponds to making a preliminary choice as to whether system R or 
‘Sis to be used with probabilities p and gq, respectively. When this is done 
R or S is used as originally detined. 

It is shown that secrecy systems with these two combining operations 
form essentially a ‘linear associative algebra’? with a unit element, an 
algebraic variety that has been extensively studied by mathematicians. 

Among the many possible secrecy systems there is one type with many 
special properties. This type we call a “pure” system. A system is pure if 
all keys are equally likely and if for any three transformations 7, 7, 7; 
in the set the product 


ras Ts 
is also a transformation in the set. That is enciphering, deciphering, and 


enciphering with any three keys must be equivalent to enciphering with 
some key. 
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With a pure cipher it is shown that all keys are essentially equivalent 


they all lead to the same set of a posteriori probabilities. Furthermore, when 
a given cryptogram is intercepted there is a set of messages that might have 
produced this cryptogram (a “residue class’) and the a posteriori prob- 
abilities of messages in this class are proportional to the @ priori probabilities. 
All the information the enemy has obtained by intercepting the cryptogram 
is a specification of the residue class. Many of the common ciphers are pure 
systems, including simple substitution with random key. In this case the 
residue class consists of all messages with the same pattern of letter repeti- 
tions as the intercepted cryptogram. 

Two systems R and S are defined to be “similar” if there exists a fixed 
transformation A with an inverse, -', such that 


R = AS. 


li R and S are similar, a one-to-one correspondence between the resulting 
cryptograms can be set up leading to the same a pos/eriori probabilities. 
The two systems are crypt analytically the same 

The second part of the paper deals with the problem of “theoretical 
secrecy.’ How secure is a system against cryptanalysis when the enemy has 
unlimited time and manpower available for the analysis of intercepted 
cryptograms? The problem is closely related to questions of communication 
in the presence of noise, and the concepts of entropy and equivocation 
developed for the communication problem find a direct application in this 
part of cryptography. 

“Perfect Secrecy” is detined by requiring of a system that after a crypto- 
gram is intercepted by the enemy the a pos/eriori probabilities of this crypto- 
gram representing various messages be identically the same as the a priori 
probabilities of the same messages before the interception. It is shown that 
perfect secrecy is possible but requires, if the number of messages is finite, 
the sume number of possible keys. If the message is thought of as being 
constantly generated at a given “rate”? R (to be detined later), key must be 
generated at the same or a greater rate. 

If a secrecy system with a finite key is used, and V letters of cryptogram 
intercepted, there will be, for the enemy, a certain set of messages with 
certain probabilities, that this eryptogram could represent. As .V increases 
the field usually narrows down until eventually there is a unique ‘‘solution”’ 
to the cryptogram; one message with probability essentially unity while all 
others are practically zero. A quantity //(.V) is defined, called the equivoca- 
tion, which measures in a statistical way how near the average cryptogram 
of N letters is to a unique solution; that is, how uncertain the enemy is of the 
original message after intercepting a cryptogram of .\ letters. Various 


properties of the equivocation are deduced——for example, the equivocation 
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of the key never increases with increasing .V. This equivocation is a theo- 
retical secrecy index-—theoretical in that it allows the enemy unlimited time 
to analyse the cryptogram. 

The function /7(.\) for a certain idealized type of cipher called the random 
cipher is determined. With certain modifications this function can be applied 
to many cases of practical interest. This gives a way of calculating approxi- 
mately how much intercepted material is required to obtain a solution to a 
secrecy system. It appears from this analysis that with ordinary languages 
and the usual types of ciphers (not codes) this “‘unicity distance” is approxi- 
mately H/(K) D. Here 1/(K) is a number measuring the “size” of the key 
space. If all keys are a priori equally likely H(A) is the logarithm of the 
number of possible keys. D is the redundancy of the language and measures 
the amount of “statistical constraint” imposed by the language. In simple 
substitution with random key //( A) is logig 26! or about 20 and D (in decimal 
digits per letter) is about .7 for English. Thus unicity occurs at about 30 
letters. 

It is possible to construct secrecy systems with a finite key for certain 
“languages” in which the equivocation does not approach zero as .V — . 
In this case, no matter how much material is intercepted, the enemy still 
does not obtain a unique solution to the cipher but is left with many alter- 
natives, all of reasonable probability. Such systems we call ideal systems. 
It is possible in any language to approximate such behavior —i.e., to make 
the approach to zero of H(.\V) recede out to arbitrarily large VV. However, 
such systems have a number of drawbacks, such as complexity and sensi- 
tivity to errors in transmission of the cryptogram. 

The third part of the paper is concerned with “practical secrecy.” Two 
systems with the same key size may both be uniquely solvable when .V 
letters have been intercepted, but differ greatly in the amount of labor 
required to effect this solution. An analysis of the basic weaknesses of sec- 
recy systems is made. This leads to methods for constructing systems which 
will require a large amount of work to solve. Finally, a certain incompat- 


ibility among the various desirable qualities of secrecy systems is discussed. 
PART | 
MATHEMATICAL SPRUCTURE OF SECRECY SYSTEMS 
2. SECRECY SYSTEMS 


As a first step in the mathematical analysis of cryptography, it is neces- 
sary to idealize the situation suitably, and to detine in a mathematically 
acceptable way what we shall mean by a secrecy system. A “schematic” 


diagram of a general secrecy system is shown in Fig. 1. At the transmitting 
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end there are two information sources —a message source and a key source. 
The key source produces a particular key from among those which are 
possible in the system. This key is transmitted by some means, supposedly 
not interceptible, for example by messenger, to the receiving end. The 
message source produces a message (the “‘clear”’ 


which is enciphered and 
the resulting cryptogram sent to the receiving end by a possibly inter- 
ceptible means, for example radio. At the receiving end the cryptogram and 


key are combined in the decipherer to recover the message. 
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Fig. 1--Schematic of a general secrecy systen 


l. 


Evidently the encipherer performs a functional operation. If M is the 
message, A the key, and EF the enciphered message, or cryptogram, we have 


E = f(M, K) 


that is F is a function of M and A, It is preferable to think of this, however, 
not as a function of two variables but as a (one parameter) family of opera- 
tions or transformations, and to write it 


E = T\M. 
The transformation 7; applied to message VM produces cryptogram &. The 
index ? corresponds to the particular key being used. 
We will assume, in general, that there are only a finite number of possible 
keys, and that each has an associated probability p, . Thus the key source is 


represented by a statistical process or device which chooses one from the set 


of transformations 7; , 72, -++ , 7, with the respective probabilities py , 
pz, +++, Pm. Similarly we will generally assume a finite number of possible 
messayes M,, M., ---, M, with associated a priori probabilities q , ¢ 


-,qg, . The possible messages, for example, might be the possible sequences 
of English letters all of length .V, and the associated probabilities are then 
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the relative frequencies of occurrence of these sequences in normal English 
text. 

At the receiving end it must be possible to recover M, knowing F and AK. 
Thus the transformations 7; in the family must have unique inverses 
T;* such that 7;7;' = T, the identity transformation. Thus: 


M = T7,'E. 


At any rate this inverse must exist uniquely for every E which can be 
obtained from an M with key 7. Hence we arrive at the detinition: A secrecy 
system is a family of uniquely reversible transformations 7; of a set of 
possible mssages into a set of cryptograms, the transformation 7; having 
an associated probability p;. Conversely any set of entities of this type will 
be called a ‘secrecy system.’ The set of possible messages will be called, 
for convenience, the ‘‘message space’ and the set of possible cryptograms 
the “cryptogram space.” 

Two secrecy systems will be the same if they consist of the same set of 
transformations 7; , with the same message and cryptogram space (range 
and domain) and the same probabilities for the keys. 

A secrecy system can be visualized mechanically as a machine with one 
or more controls on it. A sequence of letters, the message, is fed into the 
input of the machine and a second series emerges at the output. The par- 
ticular setting of the controls corresponds to the particular key being used. 
Some statistical method must be prescribed for choosing the key from all 
the possible ones. 

To make the problem mathematically tractable we shall assume that 
the enemy knows the system being used. Vhat is, he knows the family of trans 
formations 7; , and the probabilities of choosing various keys. It might be 
objected that this assumption is unrealistic, in that the cryptanalyst often 
does not know what system was used or the probabilities in question. There 
are two answers to this objection: 

1. The restriction is much weaker than appears at first, due to our broad 

detinition of what constitutes a secrecy system. Suppose a cryptog- 

rapher intercepts a message and does not know whether a substitution, 
transposition, or Vigenére type cipher was used. He can consider the 
message as being enciphered by a system in which part of the key is the 
specification of which of these types was used, the next part being the 
particular key for that type. These three different possibilities are 
assigned probabilities according to his best estimates of the a priori 
probabilities of the encipherer using the respective types of cipher. 

. The assumption is actually the one ordinarily used in cryptographic 
studies. It is pessimistic and hence safe, but in the long run realistic, 


since one must expect his system to be found out eventually. Thus, 
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even when an entirely new system is devised, so that the enemy cannot 
assign any a priori probability to it without discovering it himself, 
one must still live with the expectation of his eventual knowledge. 

The situation is similar to that occurring in the theory of games’ where it 
is assumed that the opponent “‘finds out” the strategy of play being used. 
In both cases the assumption serves to delineate sharply the opponent’s 
knowledge. 

A second possible objection to our detinition of secrecy systems is that no 
account is taken of the common practice of inserting nulls in a message and 
the use of multiple substitutes. In such cases there is not a unique crypto- 
gram for a given message and key, but the encipherer can choose at will 
from among a number of different cryptograms. This situation could be 
handled, but would only add complexity at the present stage, without sub- 
stantially altering any of the basic results. 

If the messages are produced by a Markoff process of the type described 
in (') to represent an information source, the probabilities of various mes- 
sages are determined by the structure of the Markoff process. For the present, 
however, we wish to take a more general view of the situation and regard 
the messages as merely an abstract set of entities with associated prob- 
abilities, not necessarily composed of a sequence of letters and not neces- 
sarily produced by a Markoff process. 

It should be emphasized that throughout the paper a secrecy system 
means not one, but a set of many transformations. After the key is chosen 
only one of these transformations is used and one might be led from this to 
define a secrecy system as a single transformation on a language. The 
enemy, however, does not know what key was chosen and the ‘‘might have 
been” keys are as important for him as the actual one. Indeed it is only the 
existence of these other possibilities that gives the system any secrecy. 
Since the secrecy is our primary interest, we are forced to the rather elabor- 
ate concept of a secrecy system detined above. This type of situation, where 
possibilities are as important as actualities, occurs frequently in games of 
strategy. The course of a chess game is largely controlled by threats which 
are not carried out. Somewhat similar is the ‘virtual existence”’ of unrealized 
imputations in the theory of games. 

It may be noted that a single operation on a language forms a degenerate 
type of secrecy system under our detinition-—a system with only one key of 
unit probability. Such a system has no secrecy —the cryptanalyst finds the 
message by applying the inverse of this transformation, the only one in the 
system, to the intercepted cryptogram. The decipherer and cryptanalyst 
in this case possess the same information. In general, the only difference be- 
tween the decipherer’s knowledge and the enemy cryptanalyst’s knowledge 


3See von Neumann and Morgenstern “The Theory of Games,” Princeton 1947 
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is that the decipherer knows the particular key being used, while the crypt- 
analyst knows only the a priori probabilities of the various keys in the set. 
The process of deciphering is that of applying the inverse of the particular 
transformation used in enciphering to the cryptogram. The process of crypt- 
analysis is that of attempting to determine the message (or the particular 
key) given only the cryptogram and the a@ priori probabilities of various 
kevs and messages. 

Phere are a number of difficult epistemological questions connected with 
the theory of secrecy, or in fact with any theory which involves questions of 
probability (particularly a prior? probabilities, Bayes’ theorem, etc.) when 
applied to a physical situation. Treated abstractly, probability theory can 
be put on a rigorous logical basis with the modern measure theory ap- 
proach.4° As applied to a physical situation, however, especially when 
“subjective” probabilities and unrepeatable experiments are concerned, 
there are many questions of logical validity. For example, in the approach 
to secrecy made here, a priori probabilities of various keys and messages 
are assumed known by the enemy cryptographer—-how can one determine 
operationally if his estimates are correct, on the basis of his knowledge of the 
situation? 

One can construct artificial cryptographic situations of the “urn and die”’ 
type in which the a priori probabilities have a detinite unambiguous meaning 
and the idealization used here is certainly appropriate. In other situations 
that one can imagine, for example an intercepted communication between 
Martian invaders, the a prior? probabilities would probably be so uncertain 
as to be devoid of significance. Most practical cryptographic situations lie 
somewhere between these limits. A cryptanalyst might be willing to classify 
the possible messages into the categories “reasonable,” “possible but un- 
likely”? and “unreasonable,” but feel that finer subdivision was meaningless. 

Fortunately, in practical situations, only extreme errors in a priori prob- 
abilities of keys and messages cause significant errors in the important 
parameters. This is because of the exponential behavior of the number of 


} 
| 


messages and cryptograms, and the logarithmic measures employed. 


3. REPRESENTATION OF SYSTEMS 


A secrecy system as defined above can be represented in various ways. 
ne which is convenient for illustrative purposes is a line diagram, as in 
igs. 2 and 4. The possible messages are represented by points at the left 
and the possible cryptograms by points at the right. If a certain key, say key 
1, transforms message AM, into cryptogram /, then My and FE, are connected 

‘See J. L. Doob, “Probability as Measure,” Annals of Math. Stat., v. 12, 1941, pp. 
206-214 


5A. Kolmogoroff, ““Grundbegriffe der Wahrscheinlichkeits rechnung,” Ergebnisse der 
VWathematic, v. 2, No. 3 (Berlin 1933). 
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by a line labeled 1, etc. From each possible message there must be exactly 
one line emerging for each different key. If the same is true for each 
cryptogram, we will say that the system is closed. 

A more common way of describing a system is by stating the operation 
one performs on the message for an arbitrary key to obtain the cryptogram. 
Similarly, one detines implicitly the probabilities for various keys by de- 
scribing how a key is chosen or what we know of the enemy’s habits of key 
choice. The probabilities for messages are implicitly determined by stating 
our a priort knowledge of the enemy’s language habits, the tactical situation 
(which will influence the probable content of the message) and any special 
information we may have regarding the cryptogram. 


M, 
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Line drawings for simple systems. 


$t. Some EXAMPLES OF SECRECY SYSTEMS 
In this section a number of examples of ciphers will be given. These will 
often be referred to in the remainder of the paper for illustrative purposes. 
1. Simple Substitution Cipher. 
In this cipher each letter of the message is replaced by a fixed substitute, 
usually also a letter. Thus the message, 
M = mymomymy: - - 
where mm, , M», *** are the successive letters becomes: 
E = €)€2€3€4° °° 
f (my) f(me) fms) fms) «>: 


where the function f(m) is a function with an inverse. The key is a permuta- 
tion of the alphabet (when the substitutes are letters) eg. VY GU ACD 
TBFHRSLMOVYVYZWIEJOKN P. The tirst letter V is the 
substitute for 1, G is the substitute for B, etc. 
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2. Transposition (Fixed Period d). 

The message is divided into groups of length d and a permutation applied 
to the first group, the same permutation to the second group, etc. The per- 
mutation is the key and can be represented by a permutation of the first d 
integers. Thus, for d = 5, we might have 23.154 as the permutation. 
This means that: 


My, Ms Ms My Ms Mg Mz My My My - +> becomes 


My M3 My Ms My M7 My Me Myo Myo 


Sequential application of two or more transpositions will be called compound 
transposition. If the periods are d, , d2 , +--+, d, it is clear that the result is 
a transposition of period d, where d is the least common multiple of d; , 


i a: ae 


3. Vigenére, and Variations. 
In the Vigenére cipher the key consists of a series of d letters. These are 
written repeatedly below the message and the two added modulo 26 (con- 


sidering the alphabet numbered from .1 = 0 to Z = 25. Thus 
e, = m, + k; (mod 26) 


where &, is of period d in the index 7. For example, with the key G .1 //, 


we obtain 
message NOW Sel E..<> - 
repeated key GAHGAHGA 
cryptogram TODOSANE::: 
The Vigenére of period 1 is called the Caesar cipher. It is a simple substi- 
tution in which each letter of M is advanced a fixed amount in the alphabet. 
This amount is the key, which may be any number from 0 to 25. The so- 
called Beaufort and Variant Beaufort are similar to the Vigenére, and en- 
cipher by the equations 
€; = ki— m; (mod 26) 
and 
e; = m, — k; (mod 26) 
respectively. The Beaufort of period one is called the reversed Caesar 
cipher. 
The application of two or more Vigenéres in sequence will be called the 


compound Vigenére. It has the equation 


e=m+k+1,+ --- + s,; (mod 26) 
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where &, , /,, ---, s; in general have different periods. The period of their 
sum, 

Ma i AR 
as in compound transposition, is the least common multiple of the individual 
periods. 

When the Vigenére is used with an unlimited key, never repeating, we 
have the Vernam system,® with 

e; = m; + k; (mod 26) 
the &, being chosen at random and independently among 0, 1, ---, 25. If 
the key is a meaningful text we have the “running key” cipher. 
4. Digram, Trigram, and N-gram substitution. 

Rather than substitute for letters one can substitute for digrams, tri- 
grams, etc. General digram substitution requires a key consisting of a per- 
mutation of the 26° digrams. It can be represented by a table in which the 
row corresponds to the tirst letter of the digram and the column to the second 
letter, entries in the table being the substitutes (usually also digrams). 


5. Single Mixed Alphabet Vigeneére. 
This is a simple substitution followed by a Vigenére. 
ex = f(m,) + k; 
m, = f—(e; — k,) 
The “inverse” of this system is a Vigenére followed by simple substitution 


ex; = g(m,; + ki) 


6. Matrix System. 

One method of n-gram substitution is to operate on successive n-grams 
with a matrix having an inverse. The letters are assumed numbered from 
0 to 25, making them elements of an algebraic ring. From the n-gram m, m» 

- m, of message, the matrix a;; gives an n-gram of cryptogram 


n 


e; = d,a,m; eS] heen 


j= 


®G.S. Vernam, “Cipher Printing Telegraph Systems for Secret Wire and Radio Tele 
graphic Communications,” Journal American Institute of Electrical Engineers, v. XLV, 
pp. 109-115, 1926. 

7See L. S. Hill, “Cryptography in an Algebraic Alphabet,” American Math. Monthly, 
v. 36, No. 6, 1, 1929, pp. 306-312; also ‘Concerning Certain Linear Transformation 
Apparatus of Cryptography,” v. 38, No. 3, 1931, pp. 135-154. 








ral 
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The matrix a,; is the key, and deciphering is performed with the inverse 
matrix. The inverse matrix will exist if and only if the determinant | a;; | 
has an inverse element in the ring. 

7. The Playfair Cipher. 

This is a particular type of digram substitution governed by a mixed 25 
letter alphabet written in a 5 x 5 square. (The letter J is often dropped in 
cryptographic work—it is very infrequent, and when it occurs can be re- 
placed by J.) Suppose the key square is as shown below: 


Laz eet 2 

A'G NO U 

RDMI F 

AYraeyrvs 

ABTEW 
The substitute for a digram .1C, for example, is the pair of letters at the 
other corners of the rectangle detined by .1 and C, i.e., LO, the L taken first 
since it is above 1. If the digram letters are on a horizontal line as R/, one 
uses the letters to their right DF; RI becomes DR. If the letters are on a 
vertical line, the letters below them are used. Thus PS becomes UW. If 
the letters are the same nulls may be used to separate them or one may be 
omitted, ete. 


&. Multiple Mixed Alphabet Substitution. 
In this cipher there are a set of d simple substitutions which are used 
in sequence. If the period d is four 
mM, Mz M3 My Ms My > * 
becomes 
fi(my) folme) f3(ms) fi(my) films) fo(me) +++ 


9. Autokey Cipher. 

A Vigenére type system in which either the message itself or the resulting 
cryptogram is used for the “key” is called an autokey cipher. The encipher- 
ment is started with a “priming key” (which is the entire key in our sense) 
and continued with the message or cryptogram displaced by the length of 
the priming key as indicated below, where the priming key is COMET. 
The message used as “key”: 

Message S&NA PS UPPrP iT 2s 
Key CO BETS ENOS UP 
US Z@eLeartCtocAaA yr a 


Cryptogram 
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The eryptogram used as ‘“‘key’’s* 


Message SENDS UPPLI ES 
Key COMETUSZHLOG 
Cryptogram USZHALOHOS TS 


10. /ractional Ciphers. 


In these, each letter is first enciphered into two or more letters or num 
bers and these symbols are somehow mixed (e.g. by transposition). The 
result may then be retranslated into the original alphabet. Thus, using a 
mixed 25-letter alphabet for the key, we may translate letters into two-digit 
quinary numbers by the table: 


vi23 4 
LZ CCP? 
GNOL 
DMIF 
‘HVS 
TEW 


bh 
~~ 
: pin 
—_ 


~ 
= 
w 


Thus B becomes 41. After the resulting series of numbers is transposed in 
some way they are taken in pairs and translated back into letters. 


11. Codes. 


In codes words (or sometimes syllables) are replaced by substitute letter 
groups. Sometimes a cipher of one kind or another is applied to the result. 


5. ‘VALUATIONS OF SECRECY SYSTEMS 


There are a number of different criteria that should be applied in esti- 
mating the value of a proposed secrecy system. The most important of 
these are: 


1. Amount of Secrecy. 


There are some systems that are perfect——the enemy is no better off after 
intercepting any amount of material than before. Other systems, although 
giving him some information, do not yield a unique “solution” to intercepted 
cryptograms. Among the uniquely solvable systems, there are wide varia- 
tions in the amount of labor required to effect this solution and in the 
amount of material that must be intercepted to make the solution unique. 


’ This system is trivial from the secrecy standpoint since, with the exception of the 
first d letters, the enemy is in possession of the entire ‘tkey.” 
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2. Sise of Key. 


The key must be transmitted by non-interceptible means from transmit- 
ting to receiving points. Sometimes it must be memorized. It is therefore 
desirable to have the key as small as possible. 


3. Complexity of Enciphering and Deciphering Operations. 
Enciphering and deciphering should, of course, be as simple as possible. 
If they are done manually, complexity leads to loss of time, errors, etc. If 


done mechanically, complexity leads to large expensive machines. 
4. Propagation of Errors, 


In certain types of ciphers an error of one letter in enciphering or trans- 
mission leads to a large number of errors in the deciphered text. The errors 
are spread out by the deciphering operation, causing the loss of much in- 
formation and frequent need for repetition of the cryptogram. It is naturally 
desirable to minimize this error expansion. 


5. Expansion of Message. 


In some types of secrecy systems the size of the message is increased by 
the enciphering process. This undesirable effect may be seen in systems 
where one attempts to swamp out message statistics by the addition of 
many nulls, or where multiple substitutes are used. It also occurs in many 
“concealment” types of systems (which are not usually secrecy systems in 
the sense of our detinition). 


6. THe ALGEBRA OF SECRECY SYSTEMS 


If we have two secrecy systems 7 and R we can often combine them in 
various ways to form a new secrecy system S. If 7 and R have the same 


domain (message space) we may form a kind of “weighted sum,”’ 
S = pT + gR 


Where p + g = 1. This operation consists of first making a preliminary 
choice with probabilities p and gq determining which of 7 and K is used. 
Phis choice is part of the key of S. After this is determined 7 or R is used as 
originally detined. Phe total key of S must specify which of 7 and R is used 
and which key of 7 (or R) is used. 


If 7 consists of the transformations 7). +++, Zim with probabilities Pp; , 
-, Pm and R consists of R; , ---, Ry, with probabilities qi, «++, ge then S 
pI’ + gqR consists of the transformations 7), 72, ---, T,,, Ri, +++, RB 

with probabilities pp. Pp2. >>>. PPm . Gyr. G42. °° s Qge Tespectively. 


More generally we can form the sum of a number of systems. 
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S = pl + pR+ ++: + pal’ DL pi = 1 


We note that any system 7 can be written as a sum of fixed operations 


T= pli + pole + +--+ + Pml'm 
7’, being a detinite enciphering operation of T corresponding to key choice 
i, which has probability pi. 

A second way of combining two secrecy systems is by taking the ‘‘prod- 
uct,’’ shown schematically in Fig. 3. Suppose 7 and R are two systems and 
the domain (language space) of R can be identified with the range (crypto- 
gram space) of 7. Then we can apply first 7 to our language and then R 








T > R a! bed To! be 

































































K, Ko 














Fig. 3-—-Product of two systems S = RT 


to the result of this enciphering process. This gives a resultant operation S 
which we write as a product 
S = RT 


The key for S consists of both keys of 7 and R which are assumed chosen 
according to their original probabilities and independently. Thus, if the 
m keys of 7 are chosen with probabilities 


and the » keys of R have probabilities 
/ , / 
Pi po ++ Pn, 


then S has at most mn keys with probabilities pip. . In many cases some of 
the product transformaions R,7; will be the same and can be grouped to- 
gether, adding their probabilities. 

Product encipherment is often used; for example, one follows a substi- 
tution by a transposition or a transposition by a Vigenére, or applies a code 
to the text and enciphers the result by substitution, transposition, frac- 
tionation, etc. 
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It may be noted that multiplication is not in general commutative, (we 
do not always have RS = SR), although in special cases, such as substitu- 
tion and transposition, it is. Since it represents an operation it is definition- 
ally associative. That is R(ST) = (RS)T = RST. Furthermore we have 
the laws 


p(p'T + q' R) + gS = ppT + py'R + gs 
(weighted associative law for addition) 


T(pR + gS) = pTR+ qTS 
(pR + gS) T = pRT Tr gST 


(right and left hand distributive laws) 
and 


pT + pT + PR = (p+ pT + PR 


It should be emphasized that these combining operations of addition 
and multiplication apply to secrecy systems as a whole. The product of two 
systems T7'R should not be confused with the product of the transformations 
in the systems 7R; , which also appears often in this work. The former TR 
is a secrecy system, 1e., a set of transformations with associated prob- 
abilities; the latter is a particular transformation. Further the sum of two 
systems pR + qT is a system —the sum of two transformations is not de- 
fined. The systems 7 and R may commute without the individual 7 and R,; 
commuting, e.g., if R is a Beaufort system of a given period, all keys equally 


likely, 
RiR,; += RR, 
in general, but of course RR does not depend on its order; actually 
RR = V 


the Vigenére of the same period with random key. On the other hand, if 
the individual 7; and Rj of two systems 7 and RK commute, then the svs- 
tems commute. 

A system whose M and F spaces can be identified, a very common case 
as when letter sequences are transformed into letter sequences, may be 
termed endomor phic. An endomorphic system 7 may be raised to a power 7” . 


A secrecy system 7 whose product with itself is equal to 7, i.e., for which 
IT = fT, 
will be called idempotent. For example, simple substitution, transposition 


of period p, Vigenére of period p (all with each key equally likely) are 
idempotent. 
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The set of all endomorphic secrecy systems defined in a fixed message 
space constitutes an “algebraic variety,” that is, a kind of algebra, using 
the operations of addition and multiplication. In fact, the properties of 


addition and multiplication which we have discussed may be summarized 
as follows: 

The set of endomor phic ciphers with the same message space and the two com- 
bining operations of weighted addition and multiplication form a linear associ- 
ative algebra with a unit element, apart from the fact that the coefficients in a 
weighted addition must be non-negative and sum to unity. 

The combining operations give us ways of constructing many new types 
of secrecy systems from certain ones, such as the examples given. We may 
also use them to describe the situation facing a cryptanalyst when attempt- 
ing to solve a cryptogram of unknown type. He is, in fact, solving a secrecy 
system of the type 


T = pAt pB+ --> + pS+ p’'X > p=1 


where the A, B, ---, S are known types of ciphers, with the p; their a priori 
probabilities in this situation, and p’X corresponds to the possibility of a 
completely new unknown type of cipher. 


7. PURE AND MIXED CIPHERS 


Certain types of ciphers, such as the simple substitution, the transposi- 
tion of a given period, the Vigenére of a given period, the mixed alphabet 
Vigenére, etc. (all with each key equally likely) have a certain homogeneity 
with respect to key. Whatever the key, the enciphering, deciphering and 
decrypting processes are essentially the same. This may be contrasted with 


the cipher 
pS + qT 


where S is a simple substitution and 7 a transposition of a given period. 
In this case the entire system changes for enciphering, deciphering and de- 
cryptment, depending on whether the substitution or transposition is used. 

The cause of the homogeneity in these systems stems from the group 
property —we notice that, in the above examples of homogeneous ciphers, 
the product 7,7; of any two transformations in the set is equal to a third 
transformation 7, in the set. On the other hand 7S; does not equal any 
transformation in the cipher 


DSF ql 
which contains only substitutions and transpositions, no products. 


We might detine a “pure” cipher, then, as one whose 7; form a group. 
This, however, would be too restrictive since it requires that the E space 
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be the same as the M space, i.e. that the system be endomorphic. The 

fractional transposition is as homogeneous as the ordinary transposition 

without being endomorphic. The proper definition is the following: A cipher 

T is pure if for every 7; , 7; , 7; there is a 7, such that 

OP ay £ - ar 

and every key is equally likely. Otherwise the cipher is mixed. The systems of 

Fig. 2 are mixed. Fig. 4 is pure if all keys are equally likely. 

Theorem 1: Ina pure cipher the operations T; 'T; which transform the message 
space into itself form a group whose order is m, the number of 
different keys. 

For 


wet 7 AE net to 
T; 7,7, 7; = 1 
so that each element has an inverse. The associative law is true since these 
are operations, and the group property follows from 
TET TOT, = TENT, = TOT 
efjt eit = e212 £21 ™ sil 
. . anal en rrv—lers of 
using our assumption that 7; 7; = 7°, 7; for some s. 
rh . rp lan - . . . 
rhe operation 7; 7; means, of course, enciphering the message with key 
j and then deciphering with key 7 which brings us back to the message space. 
If 7 is endomorphic, i.e. the 7; themselves transform the space Qy into itself 
(as is the case with most ciphers, where both the message space and the 
cryptogram space consist of sequences of letters), and the 7; are a group and 
equally likely, then 7 is pure, since 
ep sl ep ryy orp ah 
[7 ;7T, = TT, = T,. 
Theorem 2: The product of two pure ciphers which commute is pure. 
For if Zand R commute 7;R, = R,T,, for every i,j with suitable /, m, and 


TiRATeR1) 'TmRn = T:R;RETE To, 
= ar n.7 7 T, 
= R,T,. 


The commutation condition is not necessary, however, for the product to 
be a pure cipher. 

A system with only one key, i.e., a single definite operation 7, , is pure 
since the only choice of indices is 


eS me ‘ae 
NT, 7, = 71. 
Thus the expansion of a general cipher into a sum of such simple trans- 


formations also exhibits it as a sum of pure ciphers. 
An examination of the example of a pure cipher shown in Fig. 4 discloses 
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certain properties. The messages fall into certain subsets which we will call 
residue classes, and the possible cryptograms are divided into corresponding 
residue classes. There is at least one line from each message in a class to 
each cryptogram in the corresponding class, and no line between classes 
which do not correspond. The number of messages in a class is a divisor of 
the total number of keys. The number of lines ‘‘in parallel” from a message 
M to a cryptogram in the corresponding class is equal to the number of 
keys divided by the number of messages in the class containing the message 
(or cryptogram). It is shown in the appendix that these hold in general for 
pure ciphers. Summarize1 formally, we have: 





MESSAGE CRYPTOGRAM 
RESIDUE RESIDUE 
CLASSES CLASSES 
M, ' en 
4 
Me eo E, 
3 , 
C, Cc, 
M 3 
3 5) E, 
2 
M 
4 s: 
[ Ms ec eS. 7 
4 ’ 
Ca Ce 
um. 4 
b. i 1 ia) J 











0 


PURE SYSTEM 
Fig. 4—Pure system. 


Theorem 3: Ina pure system the messages can be divided into a set of ‘residue 
classes” Cy , Cz, «++, C, and the cryptograms into a corresponding 
set of residue classes Ci , Cp, «++, C, with the following properties: 
(1) The message residue classes are mutually exclusive and col- 

lectively contain all possible messages. Similarly for the 
cryplogram residue classes. 


(2) Enciphering any message in C; with any key produces a 
cryplogram in cs, Deciphering any cryplogram in C; with 
any key leads to a message in C; . 

(3) 


The number of messages in C; , say 9; , 1s equal lo the number 
. 4 . — ° 
of cryplograms in C; and is a divisor of k the number of keys. 








676 BELL SYSTEM TECHNICAL JOURNAL 


(4) Each message in Cy can be enciphered into each cryplogram 

in C; by exactly kg, different keys. Similarly for deci pherment. 

The importance of the concept of a pure cipher (and the reason for the 
name) lies in the fact that in a pure cipher all keys are essentially the same. 
Whatever key is used for a particular message, the a posteriori probabilities 
of all messages are identical. To see this, note that two different keys ap- 
plied to the same message lead to two cryptograms in the same residue class, 
; ; k 

say C;. The two cryptograms therefore could each be deciphered by —- 


A 


Yi 
keys into each message in C, and into no other possible messages. All keys 
being equally likely the a posteriori probabilities of various messages are 
thus 
P,(M) = P(M)Pa(E) _— P(M) P(E) _ P(M) 
P(E) YuP(M)Pw(E) P(C;) 
where M is in C;, E is in C; and the sum is over all messages in C;. If E 
and M are not in corresponding residue classes, Pe(M) = 0. Similarly it 
can be shown that the a posteriori probabilities of the different keys are 
the same in value but these values are associated with different keys when 
a different key is used. The same set of values of Pe(A) have undergone a 
permutation among the keys. Thus we have the result 
Theorem 4: Ina pure system the a posteriori probabilities of various messages 
Px(M) are independent of the key that is chosen. The a posteriori 
probabilities of the keys Pe(K) are the same in value but undergo 
a permutation with a different key choice. 

Roughly we may say that any key choice leads to the same cryptanalytic 
problem in a pure cipher. Since the different keys all result in cryptograms 
in the same residue class this means that all cryptograms in the same residue 
class are cryptanalytically equivalent—they lead to the same a posteriori 
probabilities of messages and, apart from a permutation, the same prob- 
abilities of keys. 

As an example of this, simple substitution with all keys equally likely is 
a pure cipher. The residue class corresponding to a given cryptogram F is 
the set of all cryptograms that may be obtained from £ by operations 
T;TVE. In this case 7';7°;' is itself a substitution and hence any substitution 
on £ gives another member of the same residue class. Thus, if the crypto- 
gram is 

Relat Trr?et *¢ 
then 

Ak=RDHHGDS N 

F.=ABCCODBEF 
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etc. are in the same residue class. It is obvious in this case that these crypto- 
grams are essentially equivalent. All that is of importance in a simple sub- 
stitution with random key is the pal‘ern of letter repetitions, the actual 
letters being dummy variables. Indeed we might dispense with them en- 
lirely, indicating the pattern of repetitions in E as follows: 


This notation describes the residue class but eliminates all information as 
to the specific member of the class. Thus it leaves precisely that information 
which is cryptanalytically pertinent. This is related to one method of attack- 
ing simple substitution ciphers -the method of pattern words. 

In the Caesar type cipher only the first differences mod 26 of the crypto- 
gram are significant. Two cryptograms with the same Ae; are in the same 
residue class. One breaks this cipher by the simple process of writing down 
the 26 members of the message residue class and picking out the one which 
makes sense. 

The Vigenére of period d with random key is another example of a pure 
cipher. Here the message residue class consists of all sequences with the 
same first differences as the cryptogram, for letters separated by distance d. 
For d = 3 the residue class is defined by 


mM; —- M=— C1 — &% 
Ms — mM = €2 — & 


m3; — Me = 3 — & 
Me —- Mr = 4 — C7 
where EF = e;, @, ++: is the cryptogram and m,, m2, --- is any M in the 


corresponding residue class. 

In the transposition cipher of period d with random key, the residue class 
consists of all arrangements of the e; in which no e; is moved out of its block 
of length d, and any two e; at a distance d remain at this distance. This is 
used in breaking these ciphers as follows: The cryptogram is written in 
successive blocks of length d, one under another as below (d = 5): 
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The columns are then cut apart and rearranged to make meaningful text. 
When the columns are cut apart, the only information remaining is the 
residue class of the cryptogram. 
Theorem 5: If T is pure then T;Tj;'T = T where T;T; are any two trans- 
formations of T. Conversely if this is true for any T;T; in a system 
T then T is pure. 
The first part of this theorem is obvious from the definition of a pure 
system. To prove the second part we note first that, if 7,7;'T = 7, then 
T,T;'T, is a transformation of 7. It remains to show that all keys are equi- 


probable. We have T = =. p.T, and 


an opal ap ry 
D pTiT; 'T. = >, pal.- 
The term in the left hand sum with s = 7 yields p;7;. The only term in 7; 
on the right is p;7°;. Since all coefficierts are nonnegative it follows that 


bi S pi- 


The same argument holds with 7 and 7 interchanged and consequently 


pi = Pi 


and T is pure. Thus the condition that 7,7; 7 = T might be used as an 
alternative definition of a pure system. 


8. SIMILAR SYSTEMS 


Two secrecy systems R and S will be said to be similar if there exists a 
transformation A having an inverse A‘ such that 


R = AS 


This means that enciphering with R& is the same as enciphering with S 
and then operating on the result with the transformation A. If we write 
R = S to mean R is similar to S then it is clear that RY S implies S DY R. 
Also R = Sand S > T imply R & 7 and finally R > R. These are sum- 
marized by saying that similarity is an equivalence relation. 

The cryptographic significance of similarity is that if R > S then R and 
S are equivalent from the cryptanalytic point of view. Indeed if a crypt- 
analyst intercepts a cryptogram in system S he can transform it to one in 
system R by merely applying the transformation .1 to it. A cryptogram in 
system R is transformed to one in S by applying .1 '. If R and S are ap- 
plied to the same language or message space, there is a one-to-one correspon 1- 
ence between the resulting cryptograms. Corresponding cryptograms give 
the same distribution of a pos/eriort probabilities for all messages. 

If one has a method of breaking the system R then any system S similar 
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to K can be broken by reducing to R through application of the operation A. 
This is a device that is frequently used in practical cryptanalysis. 


As a trivial example, simple substitution where the substitutes are not 
letters but arbitrary symbols is similar to simple substitution using letter 
substitutes. A second example is the Caesar and the reversed Caesar type 
ciphers. The latter is sometimes broken by first transforming into a Caesar 
type. This can be done by reversing the alphabet in the cryptogram. The 
Vigenére, Beaufort and Variant Beaufort are all similar, when the key is 
random. The ‘‘autokey” cipher (with the message used as ‘*key’’) primed 
with the key Ay; Ay --- Aq is similar to a Vigenére type with the key alter- 
nately added and subtracted Mod 26. The transformation .1 in this case is 
that of “deciphering” the autokey with a series of d A’s for the priming key. 


PART II 
THEORETICAL SECRECY 
9. INTRODUCTION 


We now consider problems connected with the ‘theoretical secrecy” of 
a system. How immune is a system to cryptanalysis when the cryptanalyst 
has unlimited time and manpower available for the analysis of crypto- 
grams? Does a cryptogram /ave a unique solution (even though it may 
require an impractical amount of work to find it) and if not how many rea- 
sonable solutions does it have? How much text in a given system must be in- 
tercepted before the solution becomes unique? Are there systems which never 
become unique in solution no matter how much enciphered text is inter- 
cepted? Are there systems for which no information whatever is given to 
the enemy no matter how much text is intercepted? In the analysis of these 
problems the concepts of entropy, redundancy and the like developed in 


“A Mathematical Theory of Communication” (hereafter referred to as 


MTC) will find a wide application. 
10. PERFECT SECRECY 
Let us suppose the possible messages are finite in number M@,, ---, M, 


and have a priori probabilities P(M,), ---, P(M,), and that these are en- 
ciphered into the possible cryptograms fF, ---, En by 


E = TM. 


Ihe cryptanalyst intercepts a particular FE and can then calculate, in 
principle at least, the a posteriori probabilities for the various messages, 
P,(M). It is natural to define perfect secrecy by the condition that, for all E 
the a posteriori probabilities are equal to the a priort probabilities inde- 
pendently of the values of these. In this case, intercepting the message has 
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given the cryptanalyst no information.’ Any action of his which depends on 
the information contained in the cryptogram cannot be altered, for all of 
his probabilities as to what the cryptogram contains remain unchanged. On 
the other hand, if the condition is nol satistied there will exist situations in 
which the enemy has certain @ priori probabilities, and certain key and 
message choices may occur for which the enemy’s probabilities do change. 
This in turn may affect his actions and thus perfect secrecy has not been 
obtained. Hence the definition given is necessarily required by our intuitive 
ideas of what perfect secrecy should mean. 

A necessary and sufficient condition for perfect secrecy can be found 
as follows: We have by Bayes’ theorem 


P( M)Py(E) 


PAM) = 
; P(E) 
in which: 
P(M) ad priort probability of message M. 
Py(E) = conditional probability of cryptogram EF if message M is 


chosen, i.e. the sum of the probabilities of all keys which pro- 
duce cryptogram FE from message M. 


P(E) = probability of obtaining cryptogram EF from any cause. 
Py(M) = a posteriori probability of message M if cryptogram Fis 


intercepted. 
For perfect secrecy Pe(M) must equal ?(M) for all F and all M. Hence 
either P(M) = 0, a solution that must be excluded since we demand the 
equality independent of the values of ?(M), or 


Pals) = PB) 
for every M and FE. Conversely if Py(/) = P(E) then 
Pe(M) = P(M) 


and we have perfect secrecy. Thus we have the result: 


Theorem 6: A necessary and suthicient condition for perfect secrecy is that 
Py (E) = P(E) 


for all M and E. That is, P(E) must be independent of M. 
Stated another way, the total probability of all keys that transform M 


* A purist might object that the enemy has obtained some information in that he knows 
a message was sent. This may be answered by having among the messages a “blank” 
corresponding to “no message.” If no message is originated the blank is enciphered and 
sent as a cryptogram. Then even this modicum of remaining information is eliminated 
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into a given cryptogram FE is equal to that of all keys transforming M; 
into the same &, for all M;, M; and E. 

Now there must be as many £’s as there are M’s since, for a fixed 1, 7; 
gives a one-to-one correspondence between all the M’s and some of the E’s. 
lor perfect secrecy Py(E) = P(E) # 0 for any of these F’s and any M. 
Hence there is at least one key transforming any M into any of these £’s. 
But all the keys from a fixed M to different E’s must be different, and 
therefore the number of different keys is at least as great as the number of M’s. 
It is possible to obtain perfect secrecy with only this number of keys, as 





Fig. 5—Perfect system. 


one shows by the following example: Let the M@; be numbered 1 to and 
the #; the same, and using n keys let 


, 1 , 

where s = 7 + j (Mod 2). In this case we see that Pe(M) = =e ad WY ) 
n 

and we have perfect secrecy. An example is shown in Fig. 5 with s 


i+ j — 1 (Mod 5). | 


Perfect systems in which the number of cryptograms, the number of 


messages, and the number of keys are all equal are characterized by the 
properties that (1) each M is connected to each E by exactly one line, (2) 
all keys are equally likely. Thus the matrix representation of the system 
is a “Latin square.” * 

In MTC it was shown that information may be conveniently measured 
by means of entropy. If we have a set of possibilities with probabilities 
pi, po, °**, pn, the entropy // is given by: 


H=-), pi log pi. 
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In a secrecy system there are two statistical choices involved, that of the 
message and of the key. We may measure the amount of information pro- 
duced when a message is chosen by 1/(M): 


H(M) = — > P(M) log P(M), 


the summation being over all possible messages. Similarly, there is an un- 
certainty associated with the choice of key given by: 


H(K) = — > P(K) log P(K). 


In perfect systems of the type described above, the amount of informa 
tion in the message is at most log » (occurring when all messages are equi 
probable). This information can be concealed completely only if the key un- 
certainty is at least log n. This is the first example of a general principle 
which will appear frequently: that there is a limit to what we can obtain 
with a given uncertainty in key —the amount of uncertainty we can intro- 
duce into the solution cannot be greater than the key uncertainty. 

The situation is somewhat more complicated if the number of messages 
is infinite. Suppose, for example, that they are generated as infinite se- 
quences of letters by a suitable Markoff process. It is clear that no finite key 
will give perfect secrecy. We suppose, then, that the key source generates 
key in the same manner, that is, as an infinite sequence of symbols. Suppose 
further that only a certain length of kev Lx is needed to encipher and de- 
cipher a length Ly of message. Let the logarithm of the number of letters 
in the message alphabet be Ry and that for the key alphabet be Rx . Then, 
from the finite case, it is evident that perfect secrecy requires 


RuLu a RxLx . 


This type of perfect secrecy is realized by the Vernam system. 

These results have been deduced on the basis of unknown or arbitrary 
a priori probabilities for the messages. The key required for perfect secrecy 
depends then on the total number of possible messages. 

One would expect that, if the message space has tixed known statistics, 
so that it has a definite mean rate R of generating information, in the sense 
of MTC, then the amount of key needed could be reduced on the average 


» 
in just this ratio ——, and this is indeed true. In fact the message can be 
VM 
passed through a transducer which eliminates the redundancy and reduces 
the expected length in just this ratio, and then a Vernam system may be 
applied to the result. Evidently the amount of key used per letter of message 
) 
is statistically reduced by a factor -.— and in this case the key source and 
vu 
information source are just matched —a bit of key completely conceals a 
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bit of message information. It is easily shown also, by the methods used in 
MTC, that this is the best that can be done. 
Perfect secrecy systems have a place in the practical picture-—they may be 


used either where the greatest importance is attached to complete secrecy 


e.g., correspondence between the highest levels of command, or in cases 
where the number of possible messages is small. Thus, to take an extreme 
example, if only two messages “‘yes’’ or ‘‘no” were anticipated, a perfect 


system would be in order, with perhaps the transformation table: 


Wweoéi«dw@®‘ A B 


yes 1 


no 0 


The disadvantage of perfect systems for large correspondence systems 
is, of course, the equivalent amount of key that must be sent. In succeeding 
sections we consider what can be achieved with smaller key size, in par- 
ticular with tinite keys. 


11. EQurivocaTION 


Let us suppose that a simple substitution cipher has been used on English 
text and that we intercept a certain amount, .\ letters, of the enciphered 
text. For .\V fairly large, more than say 50 letters, there is nearly always a 
unique solution to the cipher; i.e., a single good English sequence which 
transforms into the intercepted material by a simple substitution. With a 
smaller .V, however, the chance of more than one solution is greater; with 
\ = 15 there will generally be quite a number of possible fragments of text 
that would fit, while with .V = 8 a good fraction (of the order of 1/8) of 
all reasonable English sequences of that length are possible, since there is 
seldom more than one repeated letter in the 8. With \V = 1 any letter is 
clearly possible and has the same a posteriori probability as its a priori 
probability. For one letter the system is perfect. 

This happens generally with solvable ciphers. Before any material is 
intercepted we can imagine the a priori probabilities attached to the vari- 
ous possible messages, and also to the various keys. As material is inter- 
cepted, the cryptanalyst calculates the a posteriori probabilities; and as .\ 
increases the probabilities of certain messages increase, and, of most, de- 
crease, until finally only one is left, which has a probability nearly one, 
while the total probability of all others is nearly zero. 

This calculation can actually be carried out for very simple systems. Table 
I shows the a posleriort probabilities for a Caesar type cipher applied to 
English text, with the key chosen at random from the 26 possibilities. To 
enable the use of standard letter, digram and trigram frequency tables, the 





684 BELL SYSTEM TECHNICAL JOURNAL 


text has been started at a random point (by opening a book and putting 
a pencil down at random on the page). The message selected in this way 
begins “‘creases to ...’’ starting inside the word increases. If the message 
were known to start a sentence a different set of probabilities must be used, 
corresponding to the frequencies of letters, digrams, etc., at the beginning 
of sentences. 


TABLE I 
A Posterior’: Probabilities for a Caesar Type Cryptogram 
Decipherments N =1 V=2 V =3 V 4 
CRE AS 028 .0377 BD ob 3673 
DS FB T .038 .0314 
BAG Go i 5 .O881 
2 .029 0189 
Ce LW .020 
j , .053 .0063 
.063 .0126 
.001 
004 
.034 .1321 . 2500 
025 .0222 
071 .1195 
O80 .0377 
020 .O818 4389 
O01 
068 .0126 
.061 .0881 . 0056 
.105 . 2830 . 1667 
.025 
'B .009 
'M O15 -0056 
rN .002 
ae So, .020 
O A 001 
APC ¥-OC O82 0503 
BQ ZR O14 
H (decimal digits 1.2425 0686 6034 


The Caesar with random key is a pure cipher and the particular key chosen 


does not affect the a posteriori probabilities. To determine these we need 
merely list the possible decipherments by all keys and calculate their a 
priori probabilities. The a posleriori probabilities are these divided by their 
sum. These possible decipherments are found by the standard process of 
“running down the alphabet” from the message and are listed at the left. 
These form the residue class for the message. For one intercepted letter the 
a posteriori probabilities are equal to the a priori probabilities for letters!” 
and are shown in the column headed .V = 1. For two intercepted letters 
the probabilities are those for digrams adjusted to sum to unity and these 
are shown in the column .V = 2. 

'” The probabilities for this table were taken from frequency tables given by Fletcher 


Pratt in a book ‘Secret and Urgent” published by Blue Ribbon Books, New York, 1939, 
Although not complete, they are sufficient for present purposes. 
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Trigram frequencies have also been tabulated and these are shown in the 
column .V = 3. For four- and five-letter sequences probabilities were ob- 
tained by multiplication from trigram frequencies since, roughly, 


plijkl) = plijk) pi(l). 


Note that at three letters the field has narrowed down to four messages 
of fairly high probability, the others being small in comparison. At four 
there are two possibilities and at five just one, the correct decipherment. 

In principle this could be carried out with any system but, unless the key 
is very small, the number of possibilities is so large that the work involved 
prohibits the actual calculation. 

This set of a posteriori probabilities describes how the cryptanalyst’s 
knowledge of the message and key gradually becomes more precise as 
enciphered material is obtained. This description, however, is much too 
involved and difficult to obtain for our purposes. What is desired is a sim- 
plified description of this approach to uniqueness of the possible solutions. 

A similar situation arises in communication theory when a transmitted 
signal is perturbed by noise. It is necessary to set up a suitable measure of 
the uncertainty of what was actually transmitted knowing only the per- 
turbed version given by the received signal. In MTC it was shown that a 
natural mathematical measure of this uncertainty is the conditional en- 
tropy of the transmitted signal when the received signal is known. This 
conditional entropy was called, for convenience, the equivocation. 

From the point of view of the cryptanalyst, a secrecy system is almost 
identical with a noisy communication system. The message (transmitted 
signal) is operated on by a statistical element, the enciphering system, with 
its statistically chosen key. The result of this operation is the cryptogram 
(analogous to the perturbed signal) which is available for analysis. The 
chief differences in the two cases are: first, that the operation of the en- 
ciphering transformation is generally of a more complex nature than the 
perturbing noise in a channel; and, second, the key for a secrecy system is 
usually chosen from a finite set of possibilities while the noise in a channel 
is more often continually introduced, in effect chosen from an infinite set. 

With these considerations in mind it is natural to use the equivocation 
as a theoretical secrecy index. It may be noted that there are two signifi- 
cant equivocations, that of the key and that of the message. These will be 
denoted by //g(A) and Hg(M) respectively. They are given by: 


H,(K) = >, P(E, K) log Pg(K) 
EK 


Hx(M) = >. P(E, M) log Pe(K) 
E,M 
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in which £, M and K are the cryptogram, message and key and 

P(E, K) is the probability of key A and cryptogram EF 

P.(K) is the a posteriori probability of key A if cryptogram E is 

intercepted 

P(E, M) and Pe(M) are the similar probabilities for message instead 

of key. 

The summation in //g(A) is over all possible cryptograms of a certain length 
(say .V letters) and over all keys. For //g(M) the summation is over all 
messages and cryptograms of length .\. Thus //e(A) and Hg(M) are both 
functions of .V, the number of intercepted letters. This will sometimes be 
indicated explicitly by writing /7e(A, V) and Hg(M, V). Note that these 
are ‘total’ equivocations; 1e., we do not divide by V to obtain the equiv- 
ocation rate which was used in MTC. 

The same general arguments used to justify the equivocation as a measure 
of uncertainty in communication theory apply here as well. We note that 
zero equivocation requires that one message (or key) have unit  prob- 
ability, all others zero, corresponding to complete knowledge. Considered 
as a function of .V, the gradual decrease of equivocation corresponds to 
increasing knowledge of the original key or message. The two equivocation 
curves, plotted as functions of .V, will be called the equivocation charac- 
teristics of the secrecy system in question. 

The values of He(A, V) and He(M, \) for the Caesar type cryptogram 
considered above have been calculated and are given in the last row of 
Table L. e(A, NV) and //”(M, \) are equal in this case and are given in 
decimal digits (i.e. the logarithmic base 10 is used in the calculation). It 
should be noted that the equivocation here is for a particular cryptogram, 
the summation being only over M (or A), not over E. In general the sum- 
mation would be over all possible intercepted cryptograms of length .V 
and would give the average uncertainty. The computational difficulties 


are prohibitive for this general calculation. 


12. PROPERTIES OF EQUIVOCATION 


Equivocation may be shown to have a number of interesting properties, 


most of which tit into our intuitive picture of how such a quantity should 

behave. We will first show that the equivocation of key or of a fixed part 

of a message decreases when more enciphered material is intercepted. 

Theorem 7: The equivocation of key He(K, N) is a non-increasing function 
of N. The equivocation of the first A letters of the message is a 
non-increasing function of the number N which have been inter- 
cepted. If N letters have been intercepted, the equivocation of the 
first \ letters of message is less than or equal to that of the key. 
These may be written: 
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He(K, S) < Hel(K, N) : N, 
He(M,S) < He(M, N) S N (H for first A letters of text) 
Hre(M,N) < Hr(K, N) 


The qualification regarding 1 letters in the second result of the theorem 
is so that the equivocation will not be calculated with respect to the amount 
of message that has been intercepted. If it is, the message equivocation may 
(and usually does) increase for a time, due merely to the fact that more 
letters stand for a larger possible range of messages. The results of the 
theorem are what we might hope from a good secrecy index, since we would 
hardly expect to be worse off on the average after intercepting additional 
material than before. The fact that they can be proved gives further justi- 
fication to our use of the equivocation measure. 

The results of this theorem are a consequence of certain properties of con- 
ditional entropy proved in MTC. Thus, to show the first or second state- 
ments of Theorem 7, we have for any chance events -1 and B 


H(B) > HB). 


If we identify B with the key (knowing the first S letters of cryptogram) 


and A with the remaining V — S letters we obtain the first result. Similarly 


identifying B with the message gives the second result. The last result fol- 
lows from 
He(M) < He(K, M) = He(K) + He x(M) 
and the fact that 7e.x.(M) = O since A and E uniquely determine M. 
Since the message and key are chosen independently we have: 
H(M, K) = H(M) + H(k). 
Furthermore, 
H(M, K) = H(E, K) = H(E) + He(k), 
the first equality resulting from the fact that knowledge of M and A or of 
E and K is equivalent to knowledge of all three. Combining these two we 
obtain a formula for the equivocation of key: 
H,y(K) = H(M) + H(K) — H(E). 
In particular, if H#(M) = H(E) then the equivocation of key, Hxz(A), is 
equal to the a priori uncertainty of key, /(A). This occurs in the perfect 
systems described above. 
A formula for the equivocation of message can be found by similar means. 
We have: 
H(M, E) = H(E) + He(M) = H(M) + Hau) 
H;(M) = H(M) + Hw(E) — HE). 
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If we have a product system S = 7R, it is to be expected that the second 
enciphering process will not decrease the equivocation of message. That this 
is actually true can be shown as follows: Let M, £, , FE, be the message and 
the tirst and second encipherments, respectively. Then 

Peye(M) i Pe (M). 
Consequently 
Hep (WM) = Hy (M). 
Since, for any chance variables, x, vy, 3, Hs,(s) < H,(s), we have the desired 
result, He,(M) > He,(M). 
Theorem S: The equivocation in message of a product system S = TR is not 
less than that when only R ts used. 

Suppose now we have a system 7 which can be written as a weighted sum 

of several systems R, S, ++ >, U 


T= pR+ PS+-- + pol Cpa 


and that systems R, S, ---, U have equivocations H,, Hz, Hs, ---, Hn. 
Theorem 9: The equivocation H of a weighted sum of systems is bounded 


by the inequalities 


DV pli SU SD pt, — LD pi log p.- 


These are best limits possible. The H’s may be equivocations 
either of Rey or message. 

The upper limit is achieved, for example, in strongly ideal systems (to 
be described later) where the decomposition is into the simple transforma- 
tions of the system. The lower limit is achieved if all the systems R, S, 

{° go to completely different cryptogram spaces. This theorem is also 


proved by the general inequalities governing equivocation, 
H4(B) < H(B) < H(A) + WH y(B). 


We identify .f with the particular system being used and & with the key 

or message. 

There is a similar theorem for weighted sums of languages. For this we 
identify .1 with the particular language. 

Theorem 10: Suppose a system can be applied to languages Ly, Le, «++, Lm 
and has equivocation characteristics H,, Hy, «++, Hn. When 
applied to the weighted sum =. pil, the equivocation H is 
bounded by 


> pHi < H < Dd pHi — Dd pi log px. 
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These limits are the best possible and the equivocations in ques- 
tion can be either for key or message. 
The total redundancy Dy for V letters of message is defined by 


Dy = log G — H(M) 


where G is the total number of messages of length V and //(M) is the un- 
certainty in choosing one of these. In a secrecy system where the total 
number of possible cryptograms is equal to the number of possible messages 
of length V, H(E) < log G. Consequently 


He K) = H(K) + H(M) — H(E) 
> IN(K) — \log G — H(M)|. 
Hence 
H(K) — Hg(K) < Dy. 


This shows that, in a closed system, for example, the decrease in equivoca- 
tion of key after .V letters have been intercepted is not greater than the 
redundancy of .\ letters of the language. In such systems, which comprise 
the majority of ciphers, it is only the existence of redundancy in the original 
messages that makes a solution possible. 

Now suppose we have a pure system. Let the different residue classes of 
messages be Ci), C2,C3, ---,C,, and the corresponding set of residue classes 
of cryptograms be c : "oe oie probability of each F in C; is the 
same: 

oor 
P(E) = oe ka member of C, 


7 


ba 


where ¢, is the number of different messages in C,. Thus we have 


Hey a Sg PEO ge 


A 


Ys Yr 


P(C)) 
= = » P(C,) log 
$i 
Substituting in our equation for //z(A) we obtain: 
Theorem 11: For a pure cipher 
P(C)) 


bit 


Hy(K) = H(K) + H(M) + > PCC) log 


This result can be used to compute //¢(A) in certain cases of interest. 
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13. EQUIVOCATION FOR SIMPLE SUBSTITUTION ON A TWo LETTER LANGUAGE 


We will now calculate the equivocation in key or message when simple 
substitution is applied to a two letter language, with probabilities p and q 
for 0 and 1, and successive letters chosen independently. We have 


Hx(M) = Hs(K) = —), P(E)Psx(K) log Ps(K) 
The probability that contains exactly s 0’s in a particular permutation is: 


>( p'q’ —s + or ) 


He (K,N) = He (M,N) — DECIMAL DIGITS 


eng 





2 4 6 8 10 12 14 i6 18 20 
NUMBER OF LETTERS,N 


Fig. 6—Equivocation for simple substitution on two-letter language. 


and the a posteriori probabilities of the identity and inverting substitutions 
(the only two in the system) are respectively: 


P,(0) = pg PL «= a, 8 . 
iver + g* p* 8) i ive + ep) 


2 N , 
[here are terms for each s and hence 
Ss 


y N p'q’ 8 
HA(K,N) = — ( J pra tog Da 
E 2 5 p q ( (piqh- + gps *) 
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For p = 3,q = 3, and for p = 3, qg = 3, He(K, N) has been calculated and 
is shown in Fig. 6. 


14. THe EQuivocATION CHARACTERISTIC FOR A “RANDOM” CIPHER 
In the preceding section we have calculated the equivocation charac- 
teristic for a simple substitution applied to a two-letter language. This is 
about the simplest type of cipher and the simplest language structure pos- 
sible, yet already the formulas are so involved as to be nearly useless. What 
are we to do with cases of practical interest, say the involved transforma- 
tions of a fractional transposition system applied to English with its ex- 
tremely complex statistical structure? This complexity itself suggests a 
method of approach. Sufficiently complicated problems can frequently be 
solved statistically. To facilitate this we define the notion of a “random” 
cipher. 
We make the following assumptions: 
1. The number of possible messages of length V is T = 2"°%, thus Ro = 
log. G, where G is the number of letters in the alphabet. The number of 
possible cryptograms of length V is also assumed to be T. 


Nm 


The possible messages of length V can be divided into two groups: 

one group of high and fairly uniform a priori probability, the second 

group of negligibly small total probability. The high probability group 

will contain S = 2®% messages, where R = [/(M) N, that is, R is 

the entropy of the message source per letter. 

3. The deciphering operation can be thought of as a series of lines, as 
in Figs. 2 and 4, leading back from each £ to various M’s. We assume 
k different equiprobable keys so there will be & lines leading back from 
each £. For the random cipher we suppose that the lines from each 
FE, go back to a random selection of the possible messages. Actually, 
then, a random cipher is a whole ensemble of ciphers and the equivoca- 
tion is the average equivocation for this ensemble. 

The equivocation of key is detined by 


H(K) = >> P(E)Ps(K) log Pe(K). 


The probability that exactly m lines go back from a particular / to the high 
probability group of messages is 


k s i 
: im. 
(‘ T ( 1 


If a cryptogram with m such lines is intercepted the equivocation is log m. 


a oe ; . mi 
The probability of such a cryptogram is SK’ 


since it can be produced by 
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m keys from high probability messages each with probability = . Hence the 


n~Als 


equivocation is: 


_ - k kb s m S k—m 
Hy(K) = oe dX * (5) (1 - *) m log m 


We wish to find a simple approximation to this when & is large. If the 
expected value of m, namely m = Sk/T, is > 1, the variation of log m 
over the range where the binomial distribution assumes large values will 
be small, and we can replace log m by log m. This can now be factored out 
of the summation, which then reduces to m. Hence, in this condition, 


Sk 
Hr(K) log ‘ = log S — log T + log k 


He(K) = H(K) — DN, 


where D is the redundancy per letter of the original language (D = Dy/N). 
If m is small compared to the large k, the binomial distribution can be 
approximated by a Poisson distribution: 


k mk—m ae ‘gs 
m Pq om! 


: Sk 
where A = i Hence 


H,(K) = : ” 2. a m log m. | 
> Mm ' 


1! 


If we replace m by m + 1, we obtain: | 


os m 
ae 
He(K) = e > =, log (m+ 1). + 
I m. 
This may be used in the region where \ is near unity. For \ < 1, the only 
important term in the series is that for m = 1; omitting the others we have: 


en log 2 


d log 2 
= 2-NDR log 2. 


Hx(K) 


Il- 


To summarize: //g(K), considered as a function of V, the number of 


intercepted letters, starts off at 7(K) when NV = 0, It decreases linearly 
. s WD ls 
with a slope —D out to the neighborhood of N = DD” After a short 


transition region, //z(K) follows an exponential with “half life’? distance 
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~~ if D is measured in bits per letter. This behavior is shown in Fig. 7, to- 


D 
gether with the approximating curves. 

By a similar argument the equivocation of message can be calculated. 
It is 


Hy(M) = RoN for RN K He(K) 


Hy(M) = He(K) for RoN > He(K) 
Hy(M) = He(K) — g(N) for RON ~ He(K) 
where ¢(.\V) is the function shown in Fig. 7 with .V scale reduced by factor 
D , ; , dag , 
of R. Thus, 12(M) rises linearly with slope Ro, until it nearly intersects 
0 


H(K) 
H_(K) (DIGITS) 


H(K) - NO 








° H(K) 
NO(DIGITS) 
Fig. 7—Equivocation for random cipher. 


H (K)+1 H(K}2 


the //,(K) line. After a rounded transition it follows the 7g(A) curve down. 

It will be seen from Fig. 7 that the equivocation curves approach zero 
rather sharply. Thus we may, with but little ambiguity, speak of a point at 
which the solution becomes unique. This number of letters will be called 
the unicity distance. For the random cipher it is approximately H(A)/D. 


15. APPLICATION TO STANDARD CIPHERS 


Most of the standard ciphers involve rather complicated enciphering and 
deciphering operations. Furthermore, the statistical structure of natural 
languages is extremely involved. It is therefore reasonable to assume that 
the formulas derived for the random cipher may be applied in such cases. 
It is necessary, however, to apply certain corrections in some cases. The 
main points to be observed are the following: 
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1. We assumed for the random cipher that the possible decipherments 
of a cryptogram are a random selection from the possible messages. While 
not strictly true in ordinary systems, this becomes more nearly the case as 
the complexity of the enciphering operations and of the language structure 
increases. With a transposition cipher it is clear that letter frequencies 
are preserved under decipherment operations. This means that the possible 
decipherments are chosen from a more limited group, not the entire message 
space, and the formula should be changed. In place of Ro one uses R, the 
entropy rate for a language with independent letters but with the regular 
letter frequencies. In some other cases a definite tendency toward returning 
the decipherments to high probability messages can be seen. If there is no 
clear tendency of this sort, and the system is fairly complicated, then it is 
reasonable to use the random cipher analysis. 

2. In many cases the complete key is not used in enciphering short mes- 
sages. For example, in a simple substitution, only fairly long messages 
will contain all letters of the alphabet and thus involve the complete key. 
Obviously the random assumption does not hold for small .V in such a case, 
since all the keys which differ only in the letters not yet appearing in the 
cryptogram lead back to the same message and are not randomly distrib- 
uted. This error is easily corrected to a good approximation by the use of 
a “key appearance characteristic.’ One uses, at a particular .\, the effective 
amount of key that may be expected with that length of cryptogram. 
lor most ciphers, this is easily estimated. 

3. There are certain ‘‘end effects’? due to the definite starting of the 
message which produce a discrepancy from the random characteristics. 
If we take a random starting point in English text, the first letter (when we 
do not observe the preceding letters) has a possibility of being any letter 
with the ordinary letter probabilities. The next letter is more completely 
specified since we then have digram frequencies. This decrease in choice 
value continues for some time. The effect of this on the curve is that the 


straight line part is displaced, and approached by a curve depending on 
how much the statistical structure of the language is spread out over adja- 


cent letters. As a first approximation the curve can be corrected by shifting 
the line over to the half redundancy point—i.e., the number of letters where 
the language redundancy is half its final value. 

If account is taken of these three effects, reasonable estimates of the 
equivocation characteristic and unicity point can be made. The calcula- 
tion can be done graphically as indicated in Fig. 8. One draws the key 
appearance characteristic and the total redundancy curve Dy (which is 
usually sufficiently well represented by the line VD). The difference be- 
tween these out to the neighborhood of their intersection is /7/g(M). With 
a simple substitution cipher applied to English, this calculation gave the 
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curves shown in Fig. 9. The key appearance characteristic in this case was 
estimated by counting the number of different letters appearing in typical 
English passages of \V letters. In so far as experimental data on the simple 
substitution could be found, they agree very well with the curves of Fig. 9, 
considering the various idealizations and approximations which have been 
made. For example, the unicity point, at about 27 letters, can be shown 
experimentally to lie between the limits 20 and 30. With 30 letters there is 
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Fig. 8—Graphical calculation of equivocation. 


nearly always a unique solution to a cryptogram of this type and with 20 
it is usually easy to find a number of solutions. 

With transposition of period d (random key), H(A) = log d!, or about 
d log d/e (using a Stirling approximation for d!). If we take .6 decimal digits 
per letter as the appropriate redundancy, remembering the preservation of 
letter frequencies, we obtain about 1.7d log d/e as the unicity distance. 
This also checks fairly well experimentally. Note that in this case /”(M) 
is defined only for integral multiples of d. 

With the Vigenére the unicity point will occur at about 2d letters, and 
this too is about right. The Vigenére characteristic with the same key size 
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as simple substitution will be approximately as shown in Fig. 10. The 
Vigenére, Playfair and Fractional cases are more likely to follow the the- 
oretical formulas for random ciphers than simple substitution and trans- 
position. The reason for this is that they are more complex and give better 
mixing characteristics to the messages on which they operate. 

The mixed alphabet Vigenére (each of d alphabets mixed independently 
and used sequentially) has a key size, 


HR) =d loge: 26! = 26:34 


and its unicity point should be at about 53d letters. 

These conclusions can also be put to a rough experimental test with the 
Caesar type cipher. In the particular cryptogram analyzed in Table I, 
section 11, the function (/7g(A, .V) has been calculated and is given below, 
together with the values for a random cipher. 


N 0 1 2 3 4 5 
H (observed) : Lk 
H (calculated) 41 1 


: TF © BB 
: 2 2 USlCUe 

The agreement is seen to be quite good, especially when we remember 
that the observed // should actually be the average of many different cryp- 
tograms, and that D for the larger values of .V is only roughly estimated. 

It appears then that the random cipher analysis can be used to estimate 
equivocation characteristics and the unicity distance for the ordinary 
types of ciphers. 


16. VALIDITY OF A CRYPTOGRAM SOLUTION 


The equivocation formulas are relevant to questions which sometimes 
arise in cryptographic work regarding the validity of an alleged solution 
to a cryptogram. In the history of cryptography there have been many 
cryptograms, or possible cryptograms, where clever analysts have found 
a “solution.” It involved, however, such a complex process, or the material 
was so meager that the question arose as to whether the cryptanalyst had 
“read a solution” into the cryptogram. See, for example, the Bacon-Shake- 
speare ciphers and the ‘Roger Bacon” manuscript." 

In general we may say that if a proposed system and key solves a crypto- 
gram for a length of material considerably greater than the unicity distance 
the solution is trustworthy. If the material is of the same order or shorter 
than the unicity distance the solution is highly suspicious. 

This effect of redundancy in gradually producing a unique solution to 
a cipher can be thought of in another way which is helpful. The redundancy 
is essentially a series of conditions on the letters of the message, which 


10 See Fletcher Pratt, loc. cit. 
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insure that it be statistically reasonable. These consistency conditions pro- 
duce corresponding consistency conditions in the cryptogram. The key gives 
a certain amount of freedom to the cryptogram but, as more and more 
letters are intercepted, the consistency conditions use up the freedom al- 
lowed by the key. Eventually there is only one message and key which 
satisties all the conditions and we have a unique solution. In the random 
cipher the consistency conditions are, in a sense “orthogonal” to the ‘‘grain 
of the key” and have their full effect in eliminating messages and keys as 
rapidly as possible. This is the usual case. However, by proper design it 
is possible to “line up” the redundancy of the language with the “grain of 
the key” in such a way that the consistency conditions are automatically 
satistied and //g(AK) does not approach zero. These “‘ideal”’ systems, which 
will be considered in the next section, are of such a nature that the trans- 
formations 7°; all induce the same probabilities in the & space. 


17. IpbEAL SECRECY SYSTEMS. 


We have seen that perfect secrecy requires an infinite amount of key if 
we allow messages of unlimited length. With a finite key size, the equivoca- 
tion of key and message generally approaches zero, but not necessarily so. 
In fact it is possible for /7,(A) to remain constant at its initial value W7(K). 


Then, no matter how much material is intercepted, there is not a unique 


solution but many of comparable probability. We will define an “ideal” 
system as one in which /7g(A) and Hg(M) do not approach zero as .V > ~, 
A “strongly ideal’? system is one in which /H/g(AK) remains constant 
at H(A). 

An example is a simple substitution on an artificial language in which 
all letters are equiprobable and successive letters independently chosen. 
It is easily seen that 7e(AK) = H(A) and He(M) rises linearly along a line 
of slope log G (where G is the number of letters in the alphabet) until it 
strikes the line //(A), after which it remains constant at this value. 

With natural languages it is in general possible to approximate the ideal 
characteristic—the unicity point can be made to occur for as large .V as is 
desired. The complexity of the system needed usually goes up rapidly when 
we attempt to do this, however. It is not always possible to attain actually 
the ideal characteristic with any system of finite complexity. 

To approximate the ideal equivocation, one may, first operate on the 
message with a transducer which removes all redundancies. After this almost 
any simple ciphering system —substitution, transposition, Vigenére, etc., 
is satisfactory. The more elaborate the transducer and the nearer the 
output is to the desired form, the more closely will the secrecy system ap- 
proximate the ideal characteristic. 
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Theorem 12: A necessary and sufficient condition that T be strongly ideal is 
that, for any two keys, T;'T; is a measure preserving transforma- 
tion of the message space into ilself. 

This is true since the a posteriori probability of each key is equal to its 

a priori probability if and only if this condition is satisfied. 


18. EXAMPLES OF IDEAL SECRECY SYSTEMS 


Suppose our language consists of a sequence of letters all chosen inde- 
pendently and with equal probabilities. Then the redundancy is zero, and 
from a result of section 12, 7x(A) = H(A). We obtain the result 
Theorem 13: If all letters are equally likely and independent any closed cipher 

is strongly ideal. 

The equivocation of message will rise along the key appearance char- 
acteristic which will usually approach //(A), although in some cases it 
does not. In the cases of n-gram substitution, transposition, Vigenére, and 
variations, fractional, etc., we have strongly ideal systems for this simple 
language with Hg(M) -> H(K) as V > ~. 

Ideal secrecy systems suffer from a number of disadvantages. 

1. The system must be closely matched to the language. This requires 
an extensive study of the structure of the language by the designer. Also a 
change in statistical structure or a selection from the set of possible mes- 
sages, as in the case of probable words (words expected in this particular 
cryptogram), renders the system vulnerable to analysis. 

2. The structure of natural languages is extremely complicated, and this 
implies a complexity of the transformations required to eliminate redun- 
dancy. Thus any machine to perform this operation must necessarily be 
quite involved, at least in the direction of information storage, since a 
“dictionary” of magnitude greater than that of an ordinary dictionary is 
to be expected. 

3. In general, the transformations required introduce a bad propagation 
of error characteristic. Error in transmission of a single letter produces a 
region of changes near it of size comparable to the length of statistical effects 
in the original language. 


19, FURTHER REMARKS ON EQUIVOCATION AND REDUNDANCY 


We have taken the redundancy of “normal English” to be about .7 deci- 
mal digits per letter or a redundancy of 50°%. This is on the assumption 
that word divisions were omitted. It is an approximate figure based on sta- 
tistical structure extending over about 8 letters, and assumes the text to 
be of an ordinary type, such as newspaper writing, literary work, etc. We 
may note here a method of roughly estimating this number that is of some 
cryptographic interest. 
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A running key cipher is a Vernam type system where, in place of a random 
sequence of letters, the key is a meaningful text. Now it is known that run- 
ning key ciphers can usually be solved uniquely. This shows that English 
can be reduced by a factor of two to one and implies a redundancy of at 
least 50%. This figure cannot be increased very much, however, for a number 
of reasons, unless long range ‘“‘meaning” structure of English is considered. 

The running key cipher can be easily improved to lead to ciphering systems 
which could not be solved without the key. If one uses in place of one English 
text, about 4 different texts as key, adding them all to the message, a 


sufficient amount of key has been introduced to produce a high positive 


equivocation. Another method would be to use, say, every 10th letter of 
the text as key. The intermediate letters are omitted and cannot be used 
at any other point of the message. This has much the same effect, since 
these spaced letters are nearly independent. 

The fact that the vowels in a passage can be omitted without essential 
loss suggests a simple way of greatly improving almost any ciphering system. 
First delete all vowels, or as much of the message as possible without run- 
ning the risk of multiple reconstructions, and then encipher the residue. 
Since this reduces the redundancy by a factor of perhaps 3 or 4 to 1, the 
unicity point will be moved out by this factor. This is one way of approach- 
ing ideal systems —using the decipherer’s knowledge of English as part of 
the deciphering system. 


20. DISTRIBUTION OF EQUIVOCATION 


A more complete description of a secrecy system applied to a language 
than is afforded by the equivocation characteristics can be found by giving 
the distribution of equivocation. For N intercepted letters we consider the 
fraction of cryptograms for which the equivocation (for these particular 
F’s, not the mean //z(M)) lies between certain limits. This gives a density 
distribution function 


P(He(M), N) dHx(M) 


for the probability that for V letters 7 lies between the limits H and H + 
dH, The mean equivocation we have previously studied is the mean of this 
distribution. The function P(//”(M), V) can be thought of as plotted along 
a third dimension, normal to the paper, on the Hz(M), \ plane. If the 
language is pure, with a small influence range, and the cipher is pure, the 
function will usually be a ridge in this plane whose highest point follows 
approximately the mean //,(M), at least until near the unicity point. In 
this case, or when the conditions are nearly verified, the mean curve gives 
a reasonably complete picture of the system. 
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On the other hand, if the language is not pure, but made up of a set of 


pure components 
L = Dopls 


having different equivocation curves with the system, then the total dis- 
tribution will usually be made up of a series of ridges. There will be one for 
each L; weighted in accordance with its p; The mean equivocation char- 
acteristic will be a line somewhere in the midst of these ridges and may not 
give a very complete picture of the situation. This is shown in Fig. 11. A 
similar effect occurs if the system is not pure but made up of several systems 
with different /7 curves. 

The effect of mixing pure languages which are near to one another in sta- 
tistical structure is to increase the width of the ridge. Near the unicity 








P(H,N) 


lig. 11—Distribution of equivocation with a mixed language L = 42; + 31. 


point this tends to raise the mean equivocation, since equivocation cannot 
become negative and the spreading is chiefly in the positive direction. We 


expect, therefore, that in this region the calculations based on the random 


cipher should be somewhat low. 
PART III 
PRACTICAL SECRECY 
21. THe Work CHARACTERISTIC 

After the unicity point has been passed in intercepted material there will 
usually be a unique solution to the cryptogram. The problem of isolating 
this single solution of high probability is the problem of cryptanalysis. In 
the region before the unicity point we may say that the problem of crypt- 


analysis is that of isolating all the possible solutions of high probability 
(compared to the remainder) and determining their various probabilities. 
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Although it is always possible in principle to determine these solutions 
(by trial of each possible key for example), different enciphering systems 
show a wide variation in the amount of work required. The average amount 
of work to determine the key for a cryptogram of V letters, W(.V), measured 
say in man hours, may be called the work characteristic of the system. This 
average is taken over all messages and all keys with their appropriate prob- 
abilities. The function W(.V) is a measure of the amount of ‘practical 
secrecy” afforded by the system. 

For a simple substitution on English the work and equivocation char- 
acteristics would be somewhat as shown in Fig. 12. The dotted portion of 








N 


Fig. 12——-Typical work and equivocation characteristics. 


the curve is in the range where there are numerous possible solutions and 
these must all be determined. In the solid portion after the unicity point 
only one solution exists in general, but if only the minimum necessary data 
are given a great deal of work must be done to isolate it. As more material 
is available the work rapidly decreases toward some asymptotic value 
where the additional data no longer reduces the labor. 

Essentially the behavior shown in Fig. 12 can be expected with any type 


of secrecy system where the equivocation approaches zero. The scale of 


man hours required, however, will differ greatly with different types of 
ciphers, even when the //g(M) curves are about the same. A Vigenére or 
compound Vigenére, for example, with the same key size would have a 
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much better (i.e., much higher) work characteristic. A good practical 
secrecy system is one in which the W(\’)) curve remains sufficiently high, 
out to the number of letters one expects to transmit with the key, to prevent 
the enemy from actually carrying out the solution, or to delay it to such an 
extent that the information is then obsolete. 

We will consider in the following sections ways of keeping the function 
W(N) large, even though //x(K) may be practically zero. This is essentially 
a “max min” type of problem as is always the case when we have a battle 
of wits.'! In designing a good cipher we must maximize the minimum amount 
of work the enemy must do to break it. It is not enough merely to be sure 
none of the standard methods of cryptanalysis work—-we must be sure that 
no method whatever will break the system easily. This, in fact, has been the 
weakness of many systems; designed to resist all the known methods of 
solution, they later gave rise to new cryptanalytic techniques which rendered 
them vulnerable to analysis. 

The problem of good cipher design is essentially one of finding difficult 
problems, subject to certain other conditions. This is a rather unusual situa- 
tion, since one is ordinarily seeking the simple and easily soluble problems 
in a field. 

How can we ever be sure that a system which is not ideal and therefore 
has a unique solution for suthiciently large .V will require a large amount of 
work to break with every method of analysis? There are two approaches to 
this problem; (1) We can study the possible methods of solution available to 
the cryptanalyst and attempt to describe them in sufficiently general terms 
to cover any methods he might use. We then construct our system to resist 


ay 


this ‘‘general”’ method of solution. (2) We may construct our cipher in such 
a way that breaking it is equivalent to (or requires at some point in the 
process) the solution of some problem known to be laborious. Thus, if we 
could show that solving a certain system requires at least as much work as 
solving a system of simultaneous equations in a large number of unknowns, 
of a complex type, then we would have a lower bound of sorts for the work 
characteristic. 

The next three sections are aimed at these general problems. It is difficult 
to define the pertinent ideas involved with sufficient precision to obtain 
results in the form of mathematical theorems, but it is believed that the 
conclusions, in the form of general principles, are correct. 

‘See von Neumann and Morgenstern, loc. cit. The situation between the cipher de 
signer and cryptanalyst can be thought of as a “game” of a very simple structure; a zero 
sum two-person game with complete information, and just two ‘“moves.”’ The cipher 
designer chooses a system for his “move.” Then the cryptanalyst is informed of this 
choice and chooses a method of analysis. The “‘value”’ of the play is the average work re- 
quired to break a cryptogram in the system by the method chosen. 
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22. GENERALITIES ON THE SOLUTION OF CRYPTOGRAMS 


After the unicity distance has been exceeded in intercepted material, 
any system can be solved in principle by merely trying each possible key 
until the unique solution is obtained—-i.e., a deciphered message which 
‘makes sense”’ in the original language. A simple calculation shows that this 
method of solution (which we may call complete trial and error) is totally 
impractical except when the key is absurdly small. 

Suppose, for example, we have a key of 26! possibilities or about 26.3 
decimal digits, the same size as in simple substitution on English. This is, 
by any significant measure, a small key. It can be written on a small slip of 
paper, or memorized in a few minutes. It could be registered on 27 switches, 
each having ten positions, or on 88 two-position switches. 

Suppose further, to give the cryptanalyst every possible advantage, that 
he constructs an electronic device to try keys at the rate of one each micro- 
second (perhaps automatically selecting from the results by a x? test for 
statistical significance). He may expect to reach the right key about half 
way through, and after an elapsed time of about 2 X 1076/2 K 60? K 24 x 
365 X 10° or 3 X 10" years. 

In other words, even with a small key complete trial and error will never 
be used in solving cryptograms, except in the trivial case where the key is 
extremely small, e.g., the Caesar with only 26 possibilities, or 1.4 digits. 
The trial and error which is used so commonly in cryptography is of a 
different sort, or is augmented by other means. If one had a secrecy system 
which required complete trial and error it would be extremely safe. Such a 
system would result, it appears, if the meaningful original messages, all say 
of 1000 letters, were a random selection from the set of all sequences of 1000 
letters. If any of the simple ciphers were applied to this type of language it 
seems that little improvement over complete trial and error would be 
possible. 

The methods of cryptanalysis actually used often involve a great deal of 
trial and error, but in a different way. First, the trials progress from more 
probable to less probable hypotheses, and, second, each trial disposes of a 
large group of keys, not a single one. Thus the key space may be divided 
into say 10 subsets, each containing about the same number of keys. By at 
most 10 trials one determines which subset is the correct one. This subset is 
then divided into several secondary subsets and the process repeated. With 
the same key size (26! = 2 X 10°6) we would expect about 26 X 5 or 130 
trials as compared to 107° by complete trial and error. The possibility of 
choosing the most likely of the subsets first for test would improve this result 
even more. If the divisions were into two compartments (the best way to 
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minimize the number of trials) only 88 trials would be required. Whereas 
complete trial and error requires trials to the order of the number of keys, 
this subdividing trial and error requires only trials to the order of the key 
size in bits. 

This remains true even when the different keys have different probabilities. 
The proper procedure, then, to minimize the expected number of trials is 
to divide the key space into subsets of equiprobability. When the proper 
subset is determined, this is again subdivided into equiprobability subsets. 
If this process can be continued the number of trials expected when each 
division is into two subsets will be 


H(K) 
log 2 


If each test has S possible results and each of these corresponds to the 
key being in one of S equiprobability subsets, then 


H(K) 


a= . 
log S 


trials will be expected. The intuitive significance of these results should be 
noted. In the two-compartment test with equiprobability, each test yields 
one bit of information as to the key. If the subsets have very different prob- 
abilities, as in testing a single key in complete trial and error, only a small 
amount of information is obtained from the test. Thus with 26! equiprobable 
keys, a test of one yields only 
261 — 1 26! — 1 1 
261% 261 t 961 8 961 

or about 10°-* bits of information. Dividing into S equiprobability subsets 
maximizes the information obtained from each trial at log S, and the ex- 
pected number of trials is the total information to be obtained, that is 
IT(K), divided by this amount. 

The question here is similar to various coin weighing problems that have 
been circulated recently. A typical example is the following: It is known that 
one coin in 27 is counterfeit, and slightly lighter than the rest. A chemist’s 
balance is available and the counterfeit coin is to be isolated by a series of 
weighings. What is the least number of weighings required to do this? The 
correct answer is 3, obtained by first dividing the coins into three groups of 
9 each. Two of these are compared on the balance. The three possible results 
determine the set of 9 containing the counterfeit. This set is then divided 
into 3 subsets of 3 each and the process continued. The set of coins corre- 
sponds to the set of keys, the counterfeit coin to the correct key, and the 
weighing procedure to a trial or test. The original uncertainty is logs 27 
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bits, and each trial yields log, 3 bits of information; thus, when there is no 
“diophantine trouble,’ logs 27/log. 3 or 3 trials are sufficient. 

This method of solution is feasible only if the key space can be divided 
into a small number of subsets, with a simple method of determining the 
subset to which the correct key belongs. One does not need to assume a 
complete key in order to apply a consistency test and determine if the 
assumption is justified—an assumption on a part of the key (or as to whether 
the key is in some large section of the key space) can be tested. In other words 
it is possible to solve for the key bit by bit. 

The possibility of this method of analysis is the crucial weakness of most 
ciphering systems. For example, in simple substitution, an assumption on 
a single letter can be checked against its frequency, variety of contact, 
doubles or reversals, etc. In determining a single letter the key space is 
reduced by 1.4 decimal digits from the original 26. The same effect is seen 
in all the elementary types of ciphers. In the Vigenére, the assumption of 
two or three letters of the key is easily checked by deciphering at other 
points with this fragment and noting whether clear emerges. The com- 
pound Vigenére is much better from this point of view, if we assume a 
fairly large number of component periods, producing a repetition rate larger 
than will be intercepted. In this case as many key letters are used in en- 
ciphering each letter as there are periods. Although this is only a fraction 
of the entire key, at least a fair number of letters must be assumed before 
a consistency check can be applied. 

Our first conclusion then, regarding practical small key cipher design, is 
that a considerable amount of key should be used in enciphering each small 


element of the message. 


23. STATISTICAL MEtrHODS 


It is possible to solve many kinds of ciphers by statistical analysis. 
Consider again simple substitution. The first thing a cryptanalyst does with 
an intercepted cryptogram is to make a frequency count. If the cryptogram 
contains, say, 200 letters it is safe to assume that few, if any, of the letters 
are out of their frequency groups, this being a division into 4 sets of well 
defined frequency limits. The logarithm of the number of keys within this 
limitation may be calculated as 


log 2!9!9!6! = 14.28 


and the simple frequency count thus reduces the key uncertainty by 12 
decimal digits, a tremendous gain. 

In general, a statistical attack proceeds as follows: A certain statistic is 
measured on the intercepted cryptogram E. This statistic is such that for 
all reasonable messages M it assumes about the same value, Sx, the value 
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depending only on the particular key K that was used. The value thus ob- 
tained serves to limit the possible keys to those which would give values of 
S in the neighborhood of that observed. A statistic which does not depend 
on K or which varies as much with M as with K is not of value in limiting 
K. Thus, in transposition ciphers, the frequency count of letters gives no 
information about A—every K leaves this statistic the same. Hence one 
can make no use of a frequency count in breaking transposition ciphers. 
More precisely one can ascribe a “‘solving power’ to a given statistic S. 
For each value of S there will be a conditional equivocation of the key 
Hs(K), the equivocation when S has its particular value, and that is all 
that is known concerning the key. The weighted mean of these values 


>> P(S) Hs(K) 


gives the mean equivocation of the key when S is known, P(S) being the 
a priori probability of the particular value S. The key size H(K), less this 


” 


‘solving power” of the statistic S. 


‘ 


mean equivocation, measures the 

In a strongly ideal cipher all statistics of the cryptogram are independent 
of the particular key used. This is the measure preserving property of 
T;T;, on the E space or 7;'7;, on the M space mentioned above. 

There are good and poor statistics, just as there are good and poor methods 
of trial and error. Indeed the trial and error testing of an hypothesis is 
is a type of statistic, and what was said above regarding the best types of 
trials holds generally. A good statistic for solving a system must have the 
following properties: 

1. It must be simple to measure. 

2. It must depend more on the key than on the message if it is meant to 
solve for the key. The variation with M should not mask its variation 
with A, 

3. The values of the statistic that can be “resolved” in spite of the 
“fuzziness” produced by variation in M should divide the key space 
into a number of subsets of comparable probability, with the statistic 
specifying the one in which the correct key lies. The statistic should 
give us sizeable information about the key, not a tiny fraction of a bit. 

4. The information it gives must be simple and usable. Thus the subsets 
in which the statistic locates the key must be of a simple nature in the 
key space. 

Frequency count for simple substitution is an example of a very good 

statistic. 

Two methods (other than recourse to ideal systems) suggest themselves 
for frustrating a statistical analysis. These we may call the methods of 
diffusion and confusion. In the method of diffusion the statistical structure 
of M which leads to its redundancy is ‘‘dissipated” into long range sta- 
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tistics—i.e., into statistical structure involving long combinations of letters 
in the cryptogram. The effect here is that the enemy must intercept a tre- 
mendous amount of material to tie down this structure, since the structure 
is evident only in blocks of very small individual probability. Furthermore, 
even when he has sufficient material, the analytical work required is much 
greater since the redundancy has been diffused over a large number of 
individual statistics. An example of diffusion of statistics is operating on a 


message M = m,, m2, m3, --: with an “averaging” operation, e.g. 


‘ 

Yn = >, Mri (mod 26), 

i=] 

adding s successive letters of the message to get a letter y, . One can show 
that the redundacy of the y sequence is the same as that of the m sequence, 
but the structure has been dissipated. Thus the letter frequencies in y will 
be more nearly equal than in m, the digram frequencies also more nearly 
equal, etc. Indeed any reversible operation which produces one letter out for 
each letter in and does not have an infinite “‘memory” has an output with 
the same redundancy as the input. The statistics can never be eliminated 
without compression, but they can be spread out. 

The method of confusion is to make the relation between the simple 
statistics of E and the simple description of A a very complex and involved 
one. In the case of simple substitution, it is easy to describe the limitation 
of A imposed by the letter frequencies of F. If the connection is very in- 
volved and confused the enemy may still be able to evaluate a statistic 
S;, say, which limits the key to a region of the key space. This limitation, 
however, is to some complex region R in the space, perhaps ‘folded over” 
many times, and he has a difficult time making use of it. A second statistic 
S» limits A still further to R», hence it lies in the intersection region; but 
this does not help much because it is so difficult to determine just what the 
intersection is. 

To be more precise let us suppose the key space has certain ‘‘natural co- 
ordinates” k; , ke, -++, Rp which he wishes to determine. He measures, let 
us Say, a set of statistics 5; , sx, ---, Ss, and these are sufficient to determine 
the &; . However, in the method of confusion, the equations connecting these 
sets of variables are involved and complex. We have, say, 


filki, ke, ooe5 Ry) = $ 
falki , Re, +++, ky) = Se 


fnlki, Re, -++, Rp) = Sa, 
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and all the f; involve all the &; . The cryptographer must solve this system 
simultaneously —a difficult job. In the simple (not confused) cases the func- 
tions involve only a small number of the &;—or at least some of these do. 
One first solves the simpler equations, evaluating some of the &; and sub- 
stitutes these in the more complicated equations. 

The conclusion here is that for a good ciphering system steps should be 
taken either to diffuse or confuse the redundancy (or both). 


24. THe PROBABLE WorpD METHOD 


One of the most powerful tools for breaking ciphers is the use of probable 
words. The probable words may be words or phrases expected in the par- 
ticular message due to its source, or they may merely be common words or 
syllables which occur in any text in the language, such as the, and, tion, that, 
and the like in English. 

In general, the probable word method is used as follows: Assuming a 
probable word to be at some point in the clear, the key or a part of the key 
is determined. This is used to decipher other parts of the cryptogram and 
provide a consistency test. If the other parts come out in the clear, the 
assumption is justified. 

There are few of the classical type ciphers that use a small key and can 
resist long under a probable word analysis. From a consideration of this 
method we can frame a test of ciphers which might be called the acid test. 
It applies only to ciphers with a small key (less than, say, 50 decimal digits), 
applied to natural languages, and not using the ideal method of gaining se- 
crecy. The acid test is this: How difficult is it to determine the key or a part 
of the key knowing a small sample of message and corresponding crypto- 
gram? Any system in which this is easy cannot be very resistant, for the 
cryptanalyst can always make use of probable words, combined with trial 
and error, until a consistent solution is obtained. 

The conditions on the size of the key make the amount of trial and error 
small, and the condition about ideal systems is necessary, since these auto- 
matically give consistency checks. The existence of probable words and 
phrases is implied by the assumption of natural languages. 

Note that the requirement of difficult solution under these conditions is 
not, by itself, contradictory to the requirements that enciphering and 
deciphering be simple processes. Using functional notation we have for 
enciphering 


and for deciphering 
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Both of these may be simple operations on their arguments without the 
third equation 


K = h(M, E) 


being simple. 

We may also point out that in investigating a new type of ciphering sys- 
tem one of the best methods of attack is to consider how the key could be 
determined if a sufficient amount of M and E were given. 

The principle of confusion can be (and must be) used to create difficulties 
for the cryptanalyst using probable word techniques. Given (or assuming) 
M = m,m2,--:,m,and FE = ¢, @&, --- , e, the cryptanalyst can set up 
equations for the different key elements ; , k2, --- , &- (namely the en- 
ciphering equations). 


e: = film, me, --+ , my ky, ++ , Re) 
é& = fo(m » M2,°°* , Ms shi, are ky) 
€. = film, me, -->, me5hy, ++ , Re) 


All is known, we assume, except the &;. Each of these equations should 
therefore be complex in the &; , and involve many of them. Otherwise the 
enemy can solve the simple ones and then the more complex ones by sub- 
stitution. 

From the point of view of increasing confusion, it is desirable to have the 
f; involve several m;, especially if these are not adjacent and hence less 
correlated. This introduces the undesirable feature of error propagation, 
however, for then each e, will generally affect several m,; in deciphering, and 
an error will spread to all these. 

We conclude that much of the key should be used in an involved manner 
in obtaining any cryptogram letter from the message to keep the work 
characteristic high. Further a dependence on several uncorrelated m; is 
desirable, if some propagation of error can be tolerated. We are led by all 
three of the arguments of these sections to consider ‘‘mixing transforma- 
tions.” 


25. MIXING TRANSFORMATIONS 


A notion that has proved valuable in certain branches of probability 
theory is the concept of a mixing transformation. Suppose we have a prob- 
ability or measure space 2 and a measure preserving transformation F of 
the space into itself, that is, a transformation such that the measure of a 
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transformed region FR is equal to the measure of the initial region R. The 
transformation is called mixing if for any function defined over the space and 
any region R the integral of the function over the region F"R approaches, 
as n — x, the integral of the function over the entire space 2 multiplied 
by the volume of R. This means that any initial region R is mixed with 
uniform density throughout the entire space if F is applied a large number of 
times. In general, /"R becomes a region consisting of a large number of thin 
filaments spread throughout @. As » increases the filaments become finer 
and their density more constant. 

A mixing transformation in this precise sense can occur only in a space 
with an infinite number of points, for in a finite point space the transforma- 
tion must be periodic. Speaking loosely, however, we can think of a mixing 
transformation as one which distributes any reasonably cohesive region in 
the space fairly uniformly over the entire space. If the first region could be 
described in simple terms, the second would require very complex ones. 

In cryptography we can think of all the possible messages of length .V 
as the space 2 and the high probability messages as the region RX. This latter 
group has a certain fairly simple statistical structure. If a mixing transforma- 
tion were applied, the high probability messages would be scattered evenly 
throughout the space. 

Good mixing transformations are often formed by repeated products of 
two simple non-commuting operations. Hopf'* has shown, for example, that 
pastry dough can be mixed by such a sequence of operations. The dough is 
first rolled out into a thin slab, then folded over, then rolled, and then 
folded again, etc. 

In a good mixing transformation of a space with natural coordinates X; , 
X., +++, Ns the point NX, is carried by the transformation into a point X; , 
with 


/ 


X; = A(X, Xs, -*+, Xe) ¢ = 1,2, ++, S 


and the functions f; are complicated, involving all the variables in a “‘sensi- 
tive’ way. A small variation of any one, X;, say, changes all the X; con- 
siderably. If V3 passes through its range of possible variation the point 
NX; traces a long winding path around the space. 

Various methods of mixing applicable to statistical sequences of the type 
found in natural languages can be devised. One which looks fairly good is 
to follow a preliminary transposition by a sequence of alternating substi- 
tutions and simple linear operations, adding adjacent letters mod 26 for 
example. Thus we might take 


2 E. Hopf, “On Causality, Statistics and Probability,” Journal of Math. and Physics, 
v. 13, pp. 51-102, 1934. 
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F = LSLSLT 
where 7 is a transposition, L is a linear operation, and S is a substitution. 
26. CIPHERS OF THE TyPE 7;,F'S; 

Suppose that / is a good mixing transformation that can be applied to 
sequences of letters, and that 7; and S; are any two simple families of trans- 
formations, i.e., two simple ciphers, which may be the same. For concrete- 
ness we may think of them as both simple substitutions. 

It appears that the cipher 77'S will be a very good secrecy system from 
the standpoint of its work characteristic. In the first place it is clear on 
reviewing our arguments about statistical methods that no simple sta- 
tistics will give information about the key—any significant statistics derived 
from E must be of a highly involved and very sensitive type-—the re- 
dundancy has been both diffused and confused by the mixing transformation 
I’, Also probable words lead to a complex system of equations involving all 
parts of the key (when the mix is good), which must be solved simultane- 
ously. 

It is interesting to note that if the cipher T is omitted the remaining 
system is similar to S and thus no stronger. The enemy merely ‘‘unmixes” 
the cryptogram by application of /~' and then solves. If S is omitted the 
remaining system is much stronger than 7 alone when the mix is good, but 
still not comparable to TFS. 

The basic principle here of simple ciphers separated by a mixing trans- 
formation can of course be extended. For example one could use 


TFS jF oR; 


with two mixes and three simple ciphers. One can also simplify by using the 
same ciphers, and even the same keys as well as the same mixing transforma- 
tions. This might well simplify the mechanization of such systems. 

The mixing transformation which separates the two (or more) appear- 
ances of the key acts as a kind of barrier for the enemy—it is easy to carry 
a known element over this barrier but an unknown (the key) does not go 
easily, 

By supplying two sets of unknowns, the key for S and the key for 7, 
and separating them by the mixing transformation Ff we have “entangled” 
the unknowns together in a way that makes solution very difficult. 

Although systems constructed on this principle would be extremely safe 
they possess one grave disadvantage. If the mix is good then the propaga- 
tion of errors is bad. A transmission error of one letter will affect several 
letters on deciphering. 
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27. INCOMPATIBILITY OF THE CRITERIA FOR GOOD SYSTEMS 

The five criteria for good secrecy systems given in section 5 appear to 
have a certain incompatibility when applied to a natural language with its 
complicated statistical structure. With artificial languages having a simple 
statistical structure it is possible to satisfy all requirements simultaneously, 
by means of the ideal type ciphers. In natural languages a compromise must 
be made and the valuations balanced against one another with a view 
toward the particular application. 

If any one of the five criteria is dropped, the other four can be satistied 
fairly well, as the following examples show: 

1. If we omit the first requirement (amount of secrecy) any simple cipher 
such as simple substitution will do. In the extreme case of omitting 
this condition completely, no cipher at all is required and one sends 
the clear! 

If the size of the key is not limited the Vernam system can be used. 


w bo 


If complexity of operation is not limited, various extremely compli- 
cated types of enciphering process can be used. 

4. If we omit the propagation of error condition, systems of the type 
TFS would be very good, although somewhat complicated. 


tn 


If we allow large expansion of message, various systems are easily 
devised where the ‘‘correct’’ message is mixed with many “incorrect” 
ones (misinformation). The key determines which of these is correct. 

A very rough argument for the incompatibility of the five conditions may 
be given as follows: From condition 5, secrecy systems essentially as studied 
in this paper must be used; 1.e., no great use of nulls, etc. Perfect and ideal 
systems are excluded by condition 2 and by 3 and 4, respectively. The high 
secrecy required by 1 must then come from a high work characteristic, not 
from a high equivocation characteristic. If the key is small, the system 
simple, and the errors do not propagate, probable word methods will gen- 
erally solve the system fairly easily, since we then have a fairly simple sys- 
tem of equations for the key. 

This reasoning is too vague to be conclusive, but the general idea seems 
quite reasonable. Perhaps if the various criteria could be given quantitative 
significance, some sort of an exchange equation could be found involving 
them and giving the best physically compatible sets of values. The two most 
dithcult to measure numerically are the complexity of operations, and the 
complexity of statistical structure of the language. 


APPENDIX 
Proof of Theorem 3 


Select any message M, and group together all cryptograms that can be 
obtained from M;, by any enciphering operation 7; . Let this class of crypto- 
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,/ . . . - 
grams be C;. Group with M, all messages that can be obtained from M, 
a ‘yj . ’ ry _/ . “- 
by 7°;'T;M, , and call this class C,; . The same C; would be obtained if we 
started with any other M in C; since 


TsT ;'T:M, —_ 7M, . 

Similarly the same C; would be obtained. 

- . ‘ e * ef e . - a 

Choosing an M not in C; (if any such exist) we construct Cy and C2 in 
the same way. Continuing in this manner we obtain the residue classes 
with properties (1) and (2). Let M, and Mz be in C; and suppose 

M, = 1,T3'M,. 

If £; is in Cy and can be obtained from M, by 


Fy = TaM, = TsM, = --- = T,M,, 


then 


Tal 2'T\M, = T3T2'T\Mz = 
T,M> = TM, cee 


F 


Thus each M; in C, transforms into £; by the same number of keys. Simi- 
larly each £; in C; is obtained from any M in C; by the same number of 
keys. It follows that this number of keys is a divisor of the total number 
of keys and hence we have properties (3) and (4). 

















The Design of Reactive Equalizers* 
By A. P. BROGLE, Jr. 


This paper describes a systematic method of approximating with a finite 
number of network elements a transfer characteristic which is a prescribed func 
tion of frequency, rather than a constant, over the useful frequency band. Al 
though applied here only to input and output coupling networks as reactive 
equalizers and where loss equalization to an extremely high degree of precision 
over a wide frequency band is desired, the mathematical expressions which form 
the basis for the design are applicable to any 4-terminal network whose transfer 
characteristic is specified in a similar manner over the real frequency range. 

The selection of the appropriate form of the transfer function for equalization 
purposes is the fundamental consideration. A squared Tchebycheff polynomial is 
found to be particularly suitable to produce a desired cut-off characteristic with- 
out impairing the precision of equalization in the useful band. 

A method of polynomial approximation based on the transformation w = 
tan ¢/2 is used to obtain the coefficients of the in-band approximating function. 
Predistorting the transfer specification and minimizing the mean-square error, 
the coefficients become the Fourier cosine coefficients for an infinite frequency 


range; and are the solutions of a linear set for a finite range, o < ¢ < m/s. 


1. INTRODUCTION 


N MOST broad-band communication systems, the problems of loss 
equalization and distortion correction are fundamental. Of the various 

types of electrical networks which are found useful as equalizers and com- 
pensators, the most frequently employed are the so-called constant re- 
sistance networks. In particular, they are of three usual types, as indicated 
in Fig. 1. 

In all cases, the relationship 7,2. = R?®, which is always possible to fulfill 
if Z,; and Z, are built up of resistive and reactive components in the well- 
known manner, provides the means of altering the transmission properties 
of the circuit without affecting its impedance.' Methods are also available 
which extend the problem to more complicated configurations having these 
constant resistance properties. However, in some applications, where signal- 
to-noise ratio considerations are of importance, the resistive elements in- 
cluded as components of Z; and Z2 in these circuits place a limitation on the 
final performance of the system. Hence, the satisfactory transmission and 
impedance matching properties of these circuits are purchased at the expense 
of a substantially increased noise level. As a consequence of this limitation 
on the performance of standard constant resistance equalizers, recent work 

* The work presented in this paper is part of a thesis, “Design of Reactive Equalizers 
with Prescribed Parasitic Capacitance,” submitted by the author in partial fulfillment of 
the requirements for the degree of Master of Science at the Massachusetts Institute of 


Technology (Feb. 1949), 
1 Ref. 5, pp. 1-2. 
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has indicated the advantage of adapting reactive input and output coupling 
networks, ordinarily employed solely as impedance matching devices, to the 
additional role of partial distortion equalization.? 

As a reactive equalizer, a lossless input or output coupling network 
partially equalizes the loss characteristic of a transmission line or cable by 
providing an insertion gain characteristic to compensate for the line loss 
characteristic. However, before the rigorous formulation of the problem is 
undertaken in the following section, it is necessary to discuss briefly the role 
of input and output coupling networks as equalizers in communications 
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Fig. 1—Constant resistance networks. 
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Fig. 2—Simplified section of a broad-band transmission system, 


systems, and to outline the external requirements and limitations imposed 
by the system itself on these networks. 

The characteristics of input and output coupling networks which are of 
engineering interest are: 

(1) The contribution of the coupling circuits to the transmission per- 
formance of the system as a whole. 

(2) The impedance matching requirements between the coupling net- 
works and the transmission line. 

(3) The limitation on the maximum performance of a coupling network 
imposed by the parasitic capacitance usually present in the termination. 

These characteristics are perhaps best illustrated by a somewhat idealized 
section of a broad-band transmission system. Figure 2 represents the output 


2 Ref. 1, pp. 383-392, 
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stage of a repeater, a section of the associated transmission line, and the 
first stage of the succeeding repeater of a simplified system. 

The specification of a flat transmission characteristic over the useful 
frequency band between A and B in the figure indicates that equalization 
for the line loss of the section must occur in either or both coupling circuits, 
in the line equipment, or in all three of these circuits. For feedback amplifiers, 
the most desirable type, a flat characteristic between A and B can be specified 
only if the feedback circuits, or 8 circuits, of the amplifiers are designed to 
have no transmission variation with frequency. In general, it is possible to 
suppose the feedback factor, 8, of the amplifiers to be the appropriately 
varying function of frequency to equalize a part of the line loss, thus altering 
the transmission specification from A to B. However, the ¢ circuits must 
include regulation of other types in most cases. Hence, it is impractical to 
include much loss equalization in these circuits. 

Since satisfactory performance of the section is dependent also on the 
maintenance of a large signal-to-noise ratio, it is important that the line 
contain no sources of additional loss. It is clear, then, that the best trans- 
mission performance is obtained (1) without the use of equalization in the 
line’ and (2) when the reactive input and output coupling circuits equalize 
as large a percentage as possible of the total line loss. 

Physically, the coupling circuits will be transformers, plus any number of 
tuning and shaping elements. In addition to the primary function of metal- 
lically separating the line from the repeater amplifiers, it will be seen later 
that the transformers provide the means of adjusting, independent of the 
value of the prescribed line impedance, the final impedance level of the net- 
work to conform with the value of the parasitic capacitance present. 

Besides the contribution of the various networks in the system to the 
overall transmission performance, there is the problem of matching the 
coupling circuits to the line. For constant-resistance equalization, this 
problem is immediately solved by the relationship 7,72 = R?. Well-estab- 
lished techniques make it a relatively simple matter to design for a specified 
attenuation variation with frequency at the same time that the impedance 
of the equalizer is matched to the line. This same procedure, with certain 
modifications, can be carried over to the design of reactive equalizers. In 
Fig. 2, the transformers of the input and output coupling circuits are un- 
terminated. That is, the input of the output circuit and the output of the 
input circuit are terminated in substantially open circuits. In order to pre- 
vent the reflection of power at the junctions of the coupling circuits and the 
line, the impedances of the input and output circuits as viewed from the 
line must be made equal to the impedance of the line. This impedance re- 


3 In practice, the 8 circuits and constant resistance networks associated with the line 
actually equalize a certain percentage of the total line loss characteristic. 
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quirement is fulfilled by providing both coupling circuits with a balancing 


network connected as shown in Fig. 3. By accepting a small constant trans- 
mission loss,* the relationship 7,;Z2 = R?® is satisfied if the impedance 72 
of the balancing network is made the inverse of the transmission circuit 
impedance Z;. Because of the relative ease of designing an inverse impedance 
Z2, once Z; is known in the final stages of a particular design, it is appropriate 
to omit from further discussion the presence of the balancing networks. 

The fundamental theoretical limitation in the maximum transmission 
performance of these coupling networks is due directly to the presence of 
the parasitic tube capacitances Co and C,; . If the parasitic capacitances were 
not present, the turns ratios of the transformers in the coupling circuits 
could quite evidently be made extremely high in order to produce over any 
specified frequency band as large a transmission response as desired. How- 
ever, even though these capacitances are usually small, they always tend to 
short circuit the coupling networks whenever the impedance ratios of the 
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Fig. 3—-Balancing network arrangement. 


transformers are made too high. The determination of the maximum re- 
sponse of these networks over a prescribed frequency range is thus a basic 
problem in the design of reactive equalizers. 

The fundamental limitation on the response of these networks is expressed 
in terms of the total area available under the transfer characteristic. When 
this characteristic is a desired function over a finite frequency band, the 
maximum utilization of the area available is obviously attained when all 
the area is included in the useful band. This condition is described as a 
resistance efficiency of 100 per cent. A smaller resistance efficiency, 75 per 
cent for example, means that three-fourths of the total area under the 
characteristic is available in the useful frequency region, while the remainder 
of the area may be utilized to decrease the rate at which the characteristic 
is cut-off. Hence, the realization of a prescribed resistance efficiency in the 


4 The effective impedance of the line as viewed from the coupling circuit is equal to 
» 


twice the actual line impedance. Thus, a penalty of 10 log ms = 3db is imposed by the 


presence of the balancing network. 
5 See eq. (4) and discussion in the following section. 
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design of a reactive equalizer places a definite requirement on the behavior 
of the transfer characteristic outside the useful frequency band. 

Although the precision of equalization as a design requirement actually 
is inclusive in the term transmission performance as used previously, it is 
included here as a separate requirement to emphasize its importance in this 
problem. The specification of a flat transmission from A to B in Fig. 2 
provides the means of assigning to the tolerance of equalization a quantita- 
tive meaning. Hence, the tolerance per repeater section of the system may 
be expressed as the maximum allowable db deviation from the flat trans- 
mission characteristic, A to B, over the useful frequency band. For extremely 
broad-band systems, such as a coaxial system for simultaneous long-distance 
telephone and television transmission, many repeater sections appear in 
tandem between terminals. Thus, the deviations in each of these sections 
contribute to the system as a whole. In addition to the distances usually 
involved, repeater spacing becomes closer as the effective transmission band 
of these systems is increased. In order to design new systems with increas- 
ingly better overall tolerances, at the same time that the broad-banding 
requirements call for a greatly increased number of repeater sections per 
system, the tolerances imposed on the individual sections become exceed- 
ingly small. As a consequence, the maximum tolerance for an individual 
section must be specified as perhaps less than +0.05 db deviation. 


2. THE PROBLEM OF REACTIVE EQUALIZATION 


In this section the problem of reactive equalization will be formulated in 
terms of the special problems of input and output coupling circuit design. 
Broadly speaking, the general characteristics of input and output coupling 
networks, as outlined in the introduction to establish the practical basis for 
reactive equalization, will be further developed in order to give them a 
quantitative meaning. Because of the complexity of some derivations and 
their extensive treatment elsewhere, detailed proofs in general will be merely 
outlined. The method of analysis follows Bode’s treatment of the problem 
while the principal results taken from network theory are Guillemin’s. 

As previously stated, the unterminated case for input and output coupling 
circuits arises whenever the terminating resistance is infinite in comparison 
with the other impedances of the network.’ Figures 4 and 5 represent, re- 
spectively, an output and an input coupling network of the type illustrated 
in Fig. 2 with infinite terminations. In each figure, R, represents the line, V 
is the lossless coupling network, and C,, is the parasitic shunt capacitance 

® The so-called terminated case exists when the parasitic capacitance Co or C; in Fig. 2 
is shunted by a finite resistance. Since no essential differences exist between the two cases 


with respect to the approximation problem, an analysis for the unterminated case alone is 
sufficient to clarify the more important design considerations. 
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which limits the response over any specified frequency band. For purposes 
of analysis and design, it is convenient to represent the coupling transformers 
in the manner indicated. By adopting this equivalent representation of a 
physical transformer, the so-called high-side equivalent circuit of the trans- 
former, which includes the leakage reactance, the magnetizing inductance, 
and the input and output winding capacitances, is incorporated as part of 
the coupling network itself. 

By excluding the ideal transformer portion of the equivalent represen- 
tation of the physical transformer from the network itself, a simplification 
is possible. As shown in Figs. 6 and 7, the combination of the resistance R,, 
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Fig. 4—Output coupling circuit. 
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Fig. 5—Input coupling circuit. 


and the ideal transformer may, in each case, be replaced by a resistance 
is the step-up turns ratio of the ideal transformer. 


” 


Ry = a*R,, where “a 
R, is the specified resistance, and Ry and ‘‘a” are determined in the design 
procedure from the maximum response obtainable with the prescribed 
capacitance C, in the termination, 

The starting point for the study of these circuits is a consideration of the 
limitation on the amplitude response of these networks with frequency due 


sie a re ” Tae 
to the presence of C,, in the terminations. Since the current ratio 7 in Fig. 6 
E 
E, in Fig. 7 might be as large as desired if it were not 
+L 
for the presence of C,,, the immediate problem is that of relating the magni- 
tude of these ratios, as functions of the real frequency, to the capacitance C,. 


and the voltage ratio 


This relationship is dependent on a necessary condition for the physical 
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realizability of a driving-point impedance function. If this function is chosen 
as the Z = R + jN in the figures, the necessary condition of interest is that Z, 
as an analytic function, have no poles in the right half of the complex fre- 


quency plane and that Z approach c, se approaches infinity. By inte- 
wW 


n 
grating this function over the appropriate path in the right half of the » 
(complex frequency) plane and setting the result equal to zero, the desired 
expression becomes 


oa 


[ R dw = 5 . (1) 
0 HU n 


e 


: : : : I ae 
To show that the resistance R is related to the ratios 7 and E it 1s 
“I 
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Fig. 6—Moditfied output coupling circuit of Fig. 4 
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Fig. 7—Modified input coupling circuit of Fig. 5. 


necessary to examine the transfer of power through the output circuit of 
Fig. 6. The power driven into this circuit is | J |?R. Since the network .V is 
lossless, this is the same power, | Jz |?Ro , which reaches the line. In addition, 


“A ee - cape tay ; ae Ey I 
if the transfer impedance of the circuit is detined as Zp,(jw) = 7 = Ror 
the relationship sought is 
Ty ? Z10( jw) ‘ R / 
|— = . = e (2) 


I Ro Ry 
; ae . | #). ' 
lor the input coupling circuit, the ratio >>| is related to the transfer 


impedance and R in a similar manner. 


7 Ref. 1, pp. 278-281, 
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[E? _ |Zn(jo)? Rs 


| = = —. (3) 
E, Ry Ry 
Finally, the transmission gain @ (in nepers) is related to the current ratio 
I, : : @ ae : 
a the voltage ratio E,’ by e. Hence, the quantitative statement for 
“L 
the limitation on the response of these coupling circuits becomes 
a® a® r fe ‘ 2 
2a Z\2( Jw) T 
e dw = dw = —— , (4) 
“0 0 Ry 2C n Ry 


Equation (4) is the general formula which relates the response character- 
istic over the complete frequency range to the prescribed capacitance C, 
and the resistance Ry. This formula is especially helpful in attaching an 


analytical meaning to the term partial reactive equalization. If a’ = f(w) 
is used to describe the attenuation characteristic of a line or cable over a 
specified finite frequency band, a = kf(w) will be the transmission response, 
in nepers, which is required to equalize a stated fraction of this loss at every 
frequency in the specified range. k is then the constant (k < 1) which 
numerically expresses the degree of equalization.” 

Thus, the a = kf(w) in eq. (4) is the desired insertion gain characteristic 
to compensate partially for the line loss characteristic, and is directly related 
to this loss over a specified frequency range by a constant &. The limitation 
on the response expressed by eq. (4) will be clear if the transmission @ is now 
defined as a = ay + kf(w), where ao represents the general response level. 
Before this expression is substituted in eq. (4), however, it is necessary to 
change the limits of integration. Thus, the specification of a maximum re- 
sponse over a finite frequency band requires that the limits become a; and 
w. , the extreme frequencies of the useful band. Since R must be positive, 
this condition requires that e** be zero everywhere outside the useful range. 
Carrying out the integration, the result becomes 

us 
a <3ln = . (5) 
2C Ri | el dy 
@1 
Since kf(w) is always prescribed, ap is readily computed. 

So far, the equations have considered only the ideal case when the transfer 
characteristic e?* is zero outside the useful band. As previously stated, this 
condition specifies a resistance efficiency of 100 per cent. In practical appli- 
cations, where a finite number of network elements are employed to approxi- 

8 By (1) substituting the equivalent current source for £, (2) applying the principle 
of reciprocity to the input circuit, and (3) writing the relations for the transfer of power 


through the circuit, eq. (3) is readily derived. 
* In practice, this constant is called the “slope” of equalization. 
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mate a transfer characteristic to a specified degree of precision over the 
useful band, it is not possible for the transfer function chosen to represent 
the transfer characteristic to approximate zero outside the useful band in a 
manner to produce a resistance efficiency of 100 per cent. This limitation is 
then the prerequisite for modifying the performance which the coupling 
networks are required to achieve. The usual range of resistance efliciencies 
specified for input and output coupling network applications is approxi- 
mately 45 to 80 per cent. 

This modification of the final performance of the coupling networks may 
be examined quantitatively by referring to eqs. (1), (4), and (5). In the first 
two of these equations the integral may be taken only over the useful fre- 
quency range, w; to w:., provided that the right-hand side of each of these 
equations is multiplied by the specified resistance efficiency expressed as a 
fraction.”® In eq. (5) the equal sign holds only in the limiting case when the 
resistance efficiency is 100 per cent. If these equations are modified in the 
manner indicated, the variation of the transfer characteristic outside the 
useful frequency range may be chosen in any way which satisfies the total 
area requirements in eqs. (1) and (4) as they stand. 

Following the choice of a satisfactory transfer characteristic, the next 
general problem is the realization of a physical network which will approxi- 
mate this specified characteristic to the required degree of precision over the 
complete frequency spectrum. The solution of this problem is the main 
purpose of this paper. 

As is well-known in network theory, the general form of the squared 
magnitude of the transfer impedance of any physical two-terminal-pair reac- 
tive network terminated in resistance may be expressed as the quotient of 
two polynomials in ’. 


Zix(jw) P = Ao -+- Aw + Ay w + Peo + An w” 


é (6) 
Ry By + Biet + Brot + -+> + Bw” ») 


(XA) 4 J 
derived from 


Ro 


eq. (6) be the transfer impedance of a lossless network terminated in re- 


Before the necessary and sufficient conditions that the - 


sistance are stated, it is appropriate to develop the modifications which must 
ey xe | Z12( jo) |» - 
be made in eq. (6) if —[*— | is to approximate the transfer characteristic, 
Ro 

e**, in this problem. This requires that a closer examination be made of the 
physical limitation that the coupling networks correspond, in part, in struc- 
ture to the equivalent circuit of the coupling transformer to be used. Figure 8 
shows the high-side equivalent circuit of either coupling transformer of 
Figs. 4 and 5. 


10 


w; is usually chosen as zero. 
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In the figure, L,, represents the magnetizing inductance, Z2 represents the 
leakage reactance, and C; and C; represent, respectively, the low-side and 
high-side parasitic winding capacitances. The magnetizing inductance Lp, , 
since it is usually large so that its impedance is substantially infinite com- 
pared with the other impedances of the circuit at high frequencies, affects 
the response of the transformer at low frequencies only. Since the useful 
band ordinarily specified does not include the range of frequencies where 
the effects of L,, are noticeable, its presence may be omitted from further 
consideration. In addition, it is never practical to retain C3 as the final 
element of the reactive coupling network V. In this case, the parallel combi- 
nation of C3 and C, would, of course, seriously limit the final response of the 
network. Thus, the least number of shaping elements is a series inductance 
Ly which splits the high-side winding capacitance C; from the prescribed 
terminating capacitance C, . Hence, in general, the reactive coupling net- 
work NV is an (x — 1) element unbalanced ladder structure of alternating 
series inductances and shunt capacitances beginning with a shunt capacitance 


} J i* 
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Fig. 8—High-side equivalent circuit of either coupling transformer of Figs. 4 and 5 


and ending with a series inductance. Figure 9, then, indicates the general 
form of the coupling network to be realized by the function chosen to 
approximate e* in this problem. 

Without loss of generality, it is convenient at this point to modify Figs. 6 
and 7 in the manner indicated in Figs. 10 and 11. By including C, as part 
of V’ the problem has not been altered. However, it is necessary to recognize 
that the final adjustment of the impedance level, i.e., the choice of Ro , must 
be made in such a manner that the total area requirement, as specified in 
eq. (4), is still met. In each figure ou . , and Ze are the open-circuit driving- 
point and transfer impedances of the enw N’ 

With the element configuration specified and the reactive coupling net- 
work .V’ defined, it is now appropriate to carry out the modification in the 


Zun( jw). , ‘i 
form of |“2/®"| indicated previously. Thus, the fact that > = lat w = 0 


| Ro | sil Ro 3 
and that an » element unbalanced ladder structure of alternating series 
inductances and shunt capacitances terminated in a resistance has only an 


, . Z12(X) ae 
nth order zero of the transfer impedance, — RR at infinity, allows the 
0 
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squared magnitude of the transfer impedance in this problem to be written as 








Z12( jw) . — 1 (7) 
Ry 1+ Bia + Bow + «+: + Bw’ 
where the 7 constants B, --- B, are related to the 2 elements of the network 
by the relation 
“ bos , 
Z12( jw) S12/ Ki ) 
— = ; (8) 
Ro 1+ 22/K 
Since the desired transfer characteristic e” determines the variation of the 
polynomial B(w?) = 1+ Byw* + --- + B,w™”", a major factor in the design 
a eae - 
: la L4 Lin-1) | 
' ' 
| a | <+-— 
Ro 1=RC1 RCs | Cn 2oRa ix 
! | 
aloe Eee ee eee panes J . iis 
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Fig. 9—General form of the coupling networks of Figs. 6 and 7. 
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Fig. 1°—Output circuit of Fig. 6 with C, included as part of NV’, 
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Fig. 11—Input circuit of Fig. 7 with C,, included as part of NV’. 








is the choice of the real coefficients, B; --- B,, by a suitable method of 
polynomial approximation. 
The necessary and sufficient conditions for physical realizability place a 


Z12( jw) 7 


restriction on the B’s of eq. (7). The sufficient condition that 


represent the squared magnitude of the transfer impedance of a physical 


cess ta 
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Ne 
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Z12( jw ) 


2 
network of the type described is that > 0 for w > 0. This condi- 


0 
tion will be insured if the polynomial, 1 + | a ae Bw", has no 
negative real \? roots of odd multiplicity.'' In addition to the sufficiency 
iui) ._ @&) x. Zx(d) | 
= derived from 
Ro h(Xr) Ro 
is to be the transfer impedance of a lossless network terminated in resistance, 
it is necessary that g(A) be either even or odd and that /(A) be a Hurwitz 
polynomial.'? In this problem g(A) = 1 is surely even since all zeros of 
| Z12(d) c oo. aes . re Zy2(X) P 
occur at infinity; and the method of forming always insures 
Ry Ry . 
that (A) = m + n, where m is the even part and n is the odd part of h(A), 
is a Hurwitz polynomial. Thus, the fulfillment of the sufficient condition that 
there be no negative real A? roots of odd multiplicity of B(w?) is the assurance 


of eq. (7), if the in the usual manner 


that the B’s of eq. (7) will always produce a physical network of the con- 
figuration of Fig. 9. 

Once the conditions for physical realizability have been fulfilled, and a 
Z12(X) 


has been found in the final stages of a particular design, the network 


Ry 
: ° F ‘ * P ee m 
elements are easily calculated from a partial fraction expansion of 222 = 
n 
according to the following relation: 
, / , on " 
Zywlr) — —tre(¥)/Ro = g(A) sg) /n (9) 
Ry 1 + soo(d)/R, mtn 1+m/n’ 
2(X) m 
where syo(X) =& and s92(X) = —, 
n n 


The previous discussion of the special problems of input and output 
coupling circuit design has been based, broadly, on (1) a consideration of 
the terminating or load impedance, (2) a consideration of the shape of the 
transfer characteristic, and (3) a consideration of the conditions for physica] 
realizability. A major problem in the design is the choice of an approximat- 
ing function which satisfactorily matches the stated transfer characteristic 
over the useful frequency band and, at the same time, sharply changes slope 
near the cut-off frequency so that it approximates zero outside the useful 
band in a prescribed manner. When the transfer characteristic is a constant 
over the useful frequency band, e.g., the impedance matching and low-pass 
filter cases, techniques which employ Tchebycheff polynomials as the ap- 

Ref. 4. 

2 A Hurwitz polynomial is defined as a polynomial in \ which has the property that the 


. Pa m 
quotient of its even and odd parts, g(A) = —, 
n 


yields a reactance function. 
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proximating functions are available which make it a relatively simple 
matter to design physically realizable networks exhibiting this property of 
a sharp cut-off to zero outside the useful band.!* However, a similar method 
of applying Tchebycheff polynomials to transfer characteristics which vary 
with frequency in a prescribed manner over a finite band has not been 
evolved. In order to illustrate the preceding statements, Figs. 12 and 13 


have been included as representative of typical transfer characteristics, 
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Fig. 12—Transfer characteristic for impedance matching or low-pass filter case. 











Fig. 13—Transfer characteristic for reactive equalizer case. 


3. DERIVATION OF SPECIAL TRANSFER FUNCTION 


[In accordance with the brief discussion at the conclusion of the previous 
chapter, it is now appropriate to state that it is the purpose of this paper (1) 
to derive a transfer function which is especially suited to the problem of 
reactive equalization, and (2) to develop a systematic method which utilizes Ht 
this special transfer function to approximate satisfactorily, with a finite hy 
number of network elements, a specified transfer characteristic over the 
entire frequency spectrum. This section will consider in detail the first of 
these two main tasks in the formulation of a design method for reactive 
equalizers. 

With reference to Fig. 13, it is convenient to divide the complete transfer 


13 Ref. 4. Also Ref. 2, pp. 53-79. 
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characteristic into two separate regions. The specification over the useful 
band, 0 < w < wo, may be called the in-band region while the specification 
outside the useful band, w. < w < , may be called the out-band region. 
Thus, it is seen that the transfer characteristic over the in-band region 
depends exclusively on the a = kf(w) which is required to equalize a stated 
fraction of the power loss between repeaters while the transfer characteristic 
in the out-band region depends only on the specified resistance efficiency. 
The first step in the derivation of the special transfer function for equali- 
zation purposes is a normalization of the transfer characteristic of Fig. 13 
in terms of eq. (7). As indicated in Fig. 14,a constant, A, is chosen so that 
9 Ww 
Ke“(K < 1) is equal to unity at elias 1. This choice of the transfer 
characteristic is convenient since the transfer characteristic is now expressed 
in a form similar to the familiar form of the transfer characteristic of a low- 





IN-BAND 
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OUT-BAND __ 
REGION 








wW 
Wo 
Fig. 14—Normalized transfer characteristic of Fig. 13. 


=io 


pass filter and, hence, suitable for the addition of a Tchebycheff polynomial." 

With the transfer characteristic appropriately specified, the next step is 
to show the manner in which the denominator B(x?) of eq. (7), where this 
equation is multiplied by the factor K, can be broken up into two functions 
of x’ so that one of these functions approximates the reciprocal of the in- 
band region of the transfer characteristic while the other produces the de- 
sired cut-off characteristic. 

The derivation of the desired denominator, B(x*), begins by writing the 
transfer characteristic of Fig. 14 for the in-band region as 


1 reer 
Bi y?) ae ae (10) 


14In order to make the following derivation clear, it is suggested that the discussion 
of Tchebycheff polynomials, pp. 733-734, be examined at this time. 

16 The transmission a = ao + f(x) will be written as &f(x) for the remainder of this 
analysis. The general transmission level ao may be found in the final stages of a particular 
design when the impedance level is adjusted to conform with the prescribed C,. 
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My . ‘s 41 ’ 
In terms of B(x?) directly and a desired transmission a at the angular cut- 


off frequency wo , equation (10) becomes 
9 2ay —2ks 
B(x?) = ee | (11) 
where K = e “°. Equation (11) now represents the characteristic that is 
to be approximated over the useful frequency band while Fig. 15 shows a 


plot of this function. 
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Fig. 15—Specification for B(x?) over useful frequency band. 
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Fig. 16—Combined approximating function for B(x?) over entire frequency band. 
£ 5 1 ) 


Now, if B(x?) is broken up into two parts and represented as 


9 (9 oyr2 16 
B(x?) = f(x?) + €V2(%), (12) 
'6 It is important to note that eq. (12) now represents the approximating function over 
the entire frequency range as compared to eq. (11) which represents the function to be 
approximated only over the useful range. 
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bk f(x) 


where f(x?) is the rational function which approximates e“°e ~ 


over the 
useful band, V(x) is a Tchebycheff polynomial of order n (odd), and € is 
the coefficient of the Tchebycheff polynomial, B(x?) in Fig. 15 will be 
modified as shown in Fig. 16. In this figure it is to be noted that f(x?), the 
in-band approximating function, is represented as having a variety of vari- 
ations outside the useful band. The function has been indicated in this 
manner to emphasize that a fairly wide latitude in the choice of the behavior 
of f(x?) outside the useful is permitted since e?V%(x), the out-band ap- 
proximating function, is the predominant function in this region. In addi- 
tion, the variations of e?V%,(x) in the in-band region have been exaggerated 
in order to demonstrate their effect on the combined approximating func- 
tion, f(x?) + &V>.(«), over the useful frequency band. 
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Fig. 17—Resultant transfer function for equalization purposes, 


Finally, when the relation expressed by eq. (12) is reciprocated and re- 


ea | 210l9%) | , . —* 
plotted in terms of A ae , the result shown in eq. (13) and Fig. 17 
o | 
is obtained. 
r : ye, 2 1 
x | 2a) (13) 
Ry f(x") + € V(x) 


Comparing the resultant special transfer function shown in Fig. 17 with 
the transfer characteristic shown in Fig. 14, and assuming that f(x?) and 
the coefficient of the Tchebycheff polynomial have been suitably chosen, 
it is established contingently that the combination of functions chosen to 
represent B(x") produces the desired result. 

This brief derivation serves as a guide to the main problem of choosing a 
particular f(x?) and a particular eV;,(«) which, when added together and 
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reciprocated, approximate the transfer characteristic to the specified degree 
of precision. 

The choice of these approximating functions begins by finding a poly- 
nomial 


f(x?) = Ap + Aye? + Agr +--+ + Ann (14) 


which approximates e“° ¢ “/“ to the required degree of precision through- 
out the useful band and has an out-band variation subject to the initial 
requirements that f(x*) be positive and that the slope of f(x?) not vary 
rapidly in the immediate out-band region (approximately 1 < x < 1.5). 
For values of x greater than about 1.5, the Tchebycheff polynomial is the 
determining function, and variations in f(x?) are no longer of importance. 
A precise statement of these conditions and the exact frequency range in 
which they are valid depend on the degree of equalization and the desired 
resistance efficiency in a particular design. However, a more critical ex- 
amination of Figs. 16 and 17 indicates that the generalized conditions stated 
above are a reasonable guide in the choice of f(x?) for most applications. 

rhe main criteria for judging the acceptability of a particular out-band 
variation which accompanies the choice of in-band variation of f(.x*) to 
produce optimum precision are physical realizability and the attainment of a 
desired resistance efficiency. Considering first the condition for physical 
realizability, ~~, Ee 2 > 0 for0 < x < ~, and referring to Fig. 16, 

RH) hE Ae) ' : 7 
a negative value of f(x*) in the immediate out-band region might be of 
sufficient magnitude to cancel the positive effect of eV3,(x) and, hence, 
produce a negative value of f(«?) + e’V2.(x). However, at higher frequencies, 
the squared Tchebycheff polynomial takes on very large positive values. 
Thus, negative values and variations in f(x") are effectively reduced in the 
magnitude of their effect on 
: | Z12( jx) 7 1 
AIR | 7) + OV@ 

in direct relation to the increase in the magnitude of eV 2(x), 

In order that an accurate prediction of the resistance efficiency may be 
made, it is necessary that the slope of f(x*) + e2V3(x) increase in a uniform 
manner in the immediate out-band region. Since variations in the slope of 
f(x*) have their largest effect in the region just outside the useful band, it is, 
of course, best to prevent rapid variations in this region. 

The remaining condition on the form of f(a") is that 4, should be adjusted 
so that Ay < &%, By providing the transfer specification with a less steep 
slope requirement at low frequencies it is possible to obtain over the valuable 
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portion of the useful band an increased precision of equalization.” This 
adjustment represents an increased transmission at low frequencies. Thus, 
it is sometimes necessary to employ an equalizer of the constant resistance 
type when additional equalization is desired at low frequencies. Figures 16 
and 17 have been drawn to reflect this condition on A. 
After an f(x*) which conforms with the requirements outlined above has 
been found, it is necessary to find a 
sw? 1 2 4 ror ‘ 
eVn(xy) = Aw + Aw + --+ + Anx™ (15) 
which, when added to f(x%*), produces the desired B(«?). This procedure is 
greatly facilitated by the known properties of Tchebycheff polynomials: 
A Tchebycheff polynomial of order 7 is defined by 
V(x) = cos (n cos™!z), (16) 


This function oscillates between plus one and minus one for | x | < 1 and 
approaches + * for |x| > 1. Tabulated below are the expanded analytical 


expressions for the polynomials for 2 = 1 through x = 8. 

Vi(x) = x Vs(x) = 16x” — 20x° + 5x 

Vo(x) = 2x? - 1 Vo(x) = 32x° — 48x" + 18x? — 1 

V3(~) = 4x? — 3x Vr(x) = 64x." — 112x° > 56a? am Te 

Va(x) = 8x" — 8x? ++ 1° — Ve(x) = 128x° — 256x° + 160x* — 32x? + 1 


With the help of the recursion formula, 
xVa(x) = 3[Vnai(x) + Va_a(x)], (17) 


the corresponding expressions for x > 8 may be systematically calculated 
Figure 18 shows a plot of the Tchebycheff polynomial for n = 5. 

In the case of low-pass filters'’ and impedance matching networks,! 
Tchebycheff polynomials are often used for the solution of the approxima- 
tion problem. The function | Z;:(jx) |* in these cases has an oscillatory be- 
havior which approximates unity in the useful band, and has all its zeros 
at infinity so that the network consists of » elements of an unbalanced 
ladder structure of alternating series inductances and shunt capacitances. 
The appropriate function for | Z,2(jx) |? is 


| Z2(jx) P = (18) 


ee ge 
1+ €V,(x)’ 
'7 There is a practical limit to the reduction of A below e¢6. Referring to Figs. 13 and 


14, it is apparent that A = -. Thus, 40 is a direct measure of the impedance level over 


Ao 
the useful band, and must not be made too small if the highest practical level of response 
is to be attained. 

18 Ref. 2, pp. 53-79. 

19 Ref. 3, pp. 26-34. 
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where ¢€ is an arbitrary constant. Figure 19 shows the plot of the squared 
Tchebycheff polynomial, &V3.(x), for the values of n = 5, and e = 0.5 
and € = 0.1, while Fig. 20 shows a plot of the transfer function expressed 
in eq. (18). 

It is to be noted that the oscillatory behavior with equal maxima and 
minima of squared Tchebycheff polynomials for values of x < 1 and the 
rapid approach to +% for values of « > 1 make their use particularly 
suitable as the solution of the approximation problem for low-pass filters 
and impedance matching networks. It is now apparent that these same 
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Fig. 18—Tchebycheff polynomial, V,,(x), for nm = 5. 


properties validate their use as the out-band approximating function for 
reactive equalizers.” 

Another useful property of squared Tchebycheff polynomials as ap- 
proximating functions for low-pass filters and impedance matching net- 
works is the inclusion of the specification of the tolerance as a factor in the 
transfer function. The allowable db deviation over the useful band is related 
to € by 


9 2 

e@=e? — 1, 

where a, is the maximum pass-band loss in nepers. Thus, the appropriate 

choice of € always realizes the specified tolerance over the useful band. 
2° When better tolerances are required and when the network configuration is not 


rigidly specified, Jacobian elliptic functions, rather than Tchebycheff polynomials, might 
be employed. 
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However, it is important to observe that a given value of € automatically 
determines both the pass-band tolerance and the rate of cut-off in the out- 
band region. Hence, if a specified tolerance is to be realized in the useful 
band, no control exists over the determination of the resistance efficiency. 
Also, it is apparent from Figs. 19 and 20 that small in-band deviations are 
always obtained at the expense of lower resistance efficiencies, and vice 
versa. 


€2.V2 (x) —> 











€2=0.25 4 
€2=0.01 4 
fe) 1 
W _ 
@o- —P 


Fig. 19—Squared Tchebycheff polynomials, &V2(x), form = 5, ande = 0.5 ande = 0.1, 
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Fig. 20--Transfer function expressed in eq. (18) for the values of m and e shown in Fig. 19. 


. . oyr2 
Returning to the problem of reactive equalization, for m odd, e?V,(x) 
may be expressed as 


e2V2 (x) = (Cx? 4+ Cox + --- + Cyx”). (19) 


Thus, any 1} of eq. (15) is given by 4; = €C,. By using the expressions 
for Vi(x) through V(x) tabulated previously, or eq. (17), it is a very simple 
task to find the C, for any desired n. Thus, V2(x) = Cx? + Cox 5 a 
C,x°" is readily ascertained, and the only real problem is the choice of e’. 
If f(x?) has already been chosen, this is accomplished by an addition of 
f(x®) and &V%,.(x) for several values of e€. When a e is found such that 
the combination, when reciprocated, very closely approximates the specified 
resistance efficiency, B(x”) is completely defined. 
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The final expression for B(x*) may now be written as 


2n 


B(x?) = f(x?) + eVi(x) = (Ao + Aw? + +++ + Anv’”) 4 


/  2n 


(Aya? + +++ + And ). (20) 


In terms of eq. (20), the corresponding expression for the special transfer 
function for equalization purposes becomes 
Zyx( jx) * 
. R 
(21) 
1 
Ao + (Ar + Atle + (Aa + Anda’ foe + (An + AQ) 


’ / . . . + 
When all the A, and A, are known in a particular design, the coefficients 
B, --- B, of eq. (7) may be readily determined. Hence, the elements of the 
network may be found by using the appropriate equations of Section 2. 


4. APPROXIMATION METHOD 


This section will consider the second of the two main tasks in the formu- 
lation of the design method. Broadly speaking, the special transfer function 
derived in the previous section, eq. (13), provides the approximating func- 
tions to be used in this problem while this section develops the systematic 
method of determining the coefficients of these functions for a finite number 
of network elements. The function of most interest in the approximation 
problem is the in-band approximating function f(x). Thus, the develop- 
ment of the approximation method for reactive equalizers is concerned 
specifically with the determination, consistent with the previous limitations 
and requirements, of the coefficients, A) --- A, , of the polynomial f(x”). 

The Fourier method of polynomial approximation, first introduced by 
Wiener,*! is characterized by a transformation of the independent variable 
to make the approximating function in the new frequency domain a periodic 
function. Thus, the well-known method of Fourier analysis is available as a 
general polynomial approximation method. This method has not been ap- 
plied extensively in practical applications. However, the uniform nature of 
B(x") over the useful frequency range makes its application to the design 
of reactive equalizers of the type described here seem feasible. 

By the transformation x = tang, 2 the frequency domain, 0 < « < ~, 
is transformed to a corresponding ¢ domain, 0 < ¢ < zm. Since the range of 
interest is 0 to in the g domain, all functions may be assumed to be either 
even or odd with a period 27. Thus, any amplitude approximating function 


21 Ref, 4. 
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may be written in the g domain as a Fourier cosine series, 


filg) = do + a, cosy + a cos 2g 4+ +--+: + 4, CoS ng = >» a, cos ky. (22) 
k=0 

In particular, the correspondence of the « domain and ¢ domain may be 

conveniently illustrated as in Fig. 21. It is to be noted that the compara- 

tively limited region of the useful band, 0 < x < 1, in the x domain goes 


into half of the available range, 0 < ¢ < =, in the g domain. It is apparent, 


mia 


then, that some advantage has already been gained by this transformation. 

Before attention can be confined to the evaluation of the coefficients, ax , 
it is necessary to establish the form of the approximating function in the ¢ 
domain which corresponds to f(*?) in the frequency domain, and to relate 
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Fig. 21—Graphical representation of the transformation x = tan ‘, 


the A, in eq. (14) to the a, in eq. (22). This is accomplished by means of the 
following relationships: 


“= tan’ = — 
. Z 1+ cos¢ 
9 
1—-<x 
cos g = i+ 


cos uy = V, (cos ¢). 


Thus, the corresponding expression for eq. (22) in the frequency domain 
becomes 


filg) = ao + iV, (cosy) + aV2 (cos¢) 


+ azsV3 (cosy) + +--+ + aaV, (cosy) 
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P 9 j 3 l n 
fi (cosy) = by + b cosy + by cos? gy + b3 cos gy + ++: + 5, cos ¢ 


P 9 1 = yx 1 ma ~ 2 
xv) = lo ” 
ieee (; + ‘) ? W(; + _ 
1 oo Y F ‘4 _ x ™ 
b; baie b, 
+nliss) 4 +o, (774) 
Ao + Aix” + Aox* + Aga® + +++ + Ana 


f(x) = =< = f(x") fola*), 
” (1 + 2°) obi 


4 


1 
(1 + 2?)"* 


Therefore, it is necessary to predistort the approximated function B(x") by 


where f(x") = 


redefining the f(g) corresponding to f(x") as 


n 


f(y) = Alg) —> Do Aga™ = f(x’), (22)’ 


where 
; 2. A, ra 
(oe) = 1. cos ke — *~ _. = f(x"), 
Sil¢ 2d a °~ (+ 2) AY, 
and 
fle) = cos” — : = f(x") 
iin ae (1+ 27), 0” 


Hence, fi(g), which corresponds to the approximating function f(x?) multi- 


plied by _in the frequency domain, is the approximating function in 


1 
(1 + x)" 
the ¢ domain. In practice, the indicated predistortion of B(x*) may be carried 
out either before or after the specification has been transformed to the 


”s 


domain. Table I shows the relation of the 4, to the a, form = 3andn = 


TABLE I 


RELATION OF THE A, OF f(x?) TO THE dy OF fi(g) FOR = 3 AND Nn = 5 


n= 3 n= 5 
Ay = ao + ) + a: + G3 Ao = do + Q) + G2 + a3 + ay + 
A; = 5ao + 3a; — 3a2 — 13a; — 27a, — 45a; 
A; = 3a9 + a — 5ay — 15a; Ag = 10a + 2a, — 14a. — 14a; + 42a, + 210a, 
Az = 10a) — 2a, — 14a. + 14a; + 42a, — 2102; 
Ao = 3a9 — a, — Say + 15a Ag = 5a — 3a; — 3a. + 13a; — 27a, + 45a; 
A; = do — GQ + G2 — as A, = do — + a2 — a3 +  — a 


CE Leena 
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It is to be recognized in the following derivation and procedure that fi(¢) 


represents the actual response of the network while Bly) cos” 


n 


hmsG 


, the pre- 
distorted specification for B(x*) in the g domain, represents the desired 


response. For convenience, Big) cos” 


n¥ 4 ‘ . 
, , may be called the amplitude function 


a(y). In addition, it is important to note that a(g) is specified only over the 
range So < 5, and the restrictions on the behavior of the appreximating 


function f(g) outside this range are related to the restrictions on f(x?) in 
the out-band region of the x domain. The general problem is thus one of 
approximating the amplitude function a(g) by a Fourier cosine series, 


n 


= a); COS ke. 


k=0 

The first step towards a systematic method of obtaining the Fourier 
cosine coefficients, dp «++ da, , is the specification of the manner in which the 
tolerance of match is to be minimized. In this case, the approximation is 
always specified in the mean-square sense, i.e., the optimum coefficients are 
obtained by solving the set of linear equations which are determined when 
the integral of the error squared, 


[= | a(y) = 2. a; COS Re do, ( 3) 


k=0 


Lo) 
w 


is minimized. 

The set of linear equations which relates the a, of the approximating 
function /\(¢) to the approximated function a(y) is derived for a range 0 to s 
in the g domain with s < w by minimizing eq. (23).*° The minimum con- 
dition is specified when the derivative with respect to each coefficient a; is 
zero. Thus, 


ol ¥ ~ — 
= 2} alg) — \ a; cos kg | [—cos jg] de = 0 (24) 


0d; /0 ; k=0 


is the analytical expression for this condition. Collecting terms, 


ol a : y . P 
—— = —2 [a(y) cos je| dg + 2 bp a, cos kg | lcos jy] de 
Od; 0 : Jo Lk=0 
= —2 [ [a(y¢) cos jg] de + 2a, | cos jg cos ke dg = 0, 
J0 0 
and letting Pj. = cos jg cos ke dg and Cy = la(y) cos jyldy, the set of 
0 Jo 


* This derivation is similar to one given by R. M. Redheffer in Ref. 6, pp. 8-10. 
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linear equations becomes 


n 
> Pea, = (;. Co = Oo LD s+.) (25) 
7=0 : 
Therefore, the procedure for determining the optimum coefficients for the 
range 0 to s in the ¢ domain is as follows: First, compute the C, which 


depend on the approximated function a(¢). 


a8 
Cy = | [a(y) cos ky] de. (26) 
Jo 


Next, compute the elements of P?, given by 


sin (j — k)s " sin (j + k)s 


Pa = rs 
2(j — k) 2(j7 + k) 


(k # j); 


These elements depend only on the range s and terminate with the desired 1 
in any design. For convenience, these numbers may be arranged in the form 
of a symmetrical matrix [Pj]. Hence, the optimum coefficients are found by 
solving the matrix equation, 


[Pal X [aj] = (Ci. (j,k = 0,1, 2, ---, n) (28) 


In this problem of approximating B(x?) to a high degree of precision over 
the useful frequency range, the range in the g domain of most interest is 0 
to 5° However, before the approximation over only part of the frequency 
range is considered, it is helpful to set down the relations which apply when 
a(y) is approximated over the whole frequency range, s = 7. In this case, 
the matrix [P,.] takes on a form in which all non-diagonal entries are zero. 
Thus, 








x 0 0 0 7 
on Tv 
[Po Pu + - Pon *; 69 
Po Pu: + Pip 
oe = 0) 
2 
[Pul = - 
000. 
he 
Tv 
LE Pro . : ; Pan 2 
i | 
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The solution in this case is particularly simple, and gives the well-known 
Fourier coefficients, 


a=+ | ae) de (j = 0), 
T 0 


? , ; J . . 
a; = s [ a(y) cos ]¢ de (j ¥ 0). 
T 0 


Hence, each coefficient a; is dependent only on the area under the correspond- 
ing function a(y) cos j¢. 

This result, even though it simplifies the procedure of calculating the a; 
in eq. (28), has only limited usefulness in this problem. As mentioned above, 
the range of direct interest extends only to s = > 


“ 


. Thus, an approximation 


over the whole range requires that an f(x?) be arbitrarily specified in the 
out-band region. Such a procedure, in this case, is an unnecessary restriction 
on the form of /(x«*) outside the useful frequency range. Thus, an approxima- 


tion over a finite range 0 to 5 is the procedure to be considered in detail. 


Starting as before, the system of equations in matrix notation which cor- 
responds to eq. (28) is 





5 1 0 - 0 : ay} | Cy 
¥ : i : 0-7 as 
1 3 3 

— © § 23 rd i cal al 
9 - - 0 ; i 5 as} |Cs 
ty oy G at 1s 

















where the elements of [Pj] up to and including Ps; have been evaluated. 
Hence, the problem is the solution of the first (7 + 1) of these equations 
for the coefficients ap --- ad,. In practice, this solution may be simplified 
for a desired » by computing once and for all the elements of the inverse 
matrix [Py]~!. This matrix is formed by replacing each element of the 
determinant || Px || by its minor, dividing each minor by this determinant, 
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and interchanging rows and columns. Thus, the solution of the a; is ex- 
pressed directly in terms of the C; and becomes 


n 

[a] = [Pal X [CG] or a; = DS PRC. (29) 

)=0 

The sufficiency of this procedure is established when it is proved that the 
determinant PP, is different from zero for the particular value of s con- 
sidered. Since s is a rational multiple of m in this case and all non-diagonal 
entries are algebraic numbers, 7 cannot satisfy an equation with algebraic 
coefficients to make Pj, = 0. Thus, the system of eq. (29) is a unique 
solution, and this solution gives the absolute minimum in the sense that 
no other set of a; will produce a smaller mean-square error over the range 


ry tod 
05° 


However, for some values of » the determinant of coefficients becomes 
extremely small. This condition produces very large numerical values of the 
elements of [Pj,]~!. Since the a; and C; are usually small compared with 
these elements, the accuracy of the solution is impaired. Hence, the system 
of eq. (29) in some cases represents a set of nearly dependent equations 
with a fairly wide range of solution. This practical limitation on the unique- 
ness of these equations may be overcome quite readily by arbitrarily chang- 
ing one of these equations to produce, for calculation purposes, a dependent 
set of equations. It turns out that the most expedient choice of this change 


: a a ae oe 7 
is to replace the Pov = 5 ol [Pix] by Poo = 1 rhis, in effect, modities the 
weighting of ay in these equations and does not, in general, limit the useful- 


; ; els T 
ness of the result. Hence, the system of eq. (28) with ; replaced by ~ de- 


termines a set of coefficients, a +--+ a, , which are reasonably close to the 
optimum tor s = > 
It is appropriate at this point to indicate a practical modification in the 
approximation method which serves, incidentally, to clarify the reasons for 
accepting as suitable a set of coefficients that are not the optimum a; over 
the useful band in the g domain. 
This modification arises since the foregoing method has considered only 


us ° ° 
the average error over the range 0 to 5. However, an analysis of the per- 


centage error in f(x), and of the corresponding deviation in @ over this 
range, shows that the approximation to a(y) is most critical at high fre- 
quencies and becomes decreasingly critical as lower frequencies are reached. 


Thus, in any design, it is necessary to make a slight adjustment of the 
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coefficients ay --- a, after they have been obtained from eq. (29) in order 


n 


to compensate for this decreased tolerance of p a; cos jy at high frequencies 


j=0 
in the useful band. The exact method of accomplishing this modification 
depends on the particular design and the ingenuity of the designer. Never- 
theless, no more than a few trials are necessary, in general, to produce the 
desired precision at all frequencies in the useful band. 

In practice, then, it is not appropriate that the Fourier cosine coefficients 
finally chosen represent the optimum coefficients in the mean-square sense. 
However, the important result established is that a systematic method 
which realizes a satisfactory set of coefficients Ay --- A, of f(x?) has been 
developed. 

















Fig. 22—Input coupling network configuration. 


5. ILLUSTRATIVE DESIGN 


The numerical example which will be considered is the design of an input 
coupling network to equalize partially the loss characteristic of a coaxial 
line. On the basis of the previous discussion of the design method it is ad- 
vantageous to break down the procedure into four general operations: 

(1) Network Specifications 

(2) Transfer Specifications 

(3) Solution of Approximation Problem 

(4) Realization of Non-dissipative Network 
The first two of these operations are the choice of the appropriate form of 
the design requirements while the last two represent the major divisions in 
the procedure for designing the network to meet these requirements. 

In this design, a set of network requirements which are consistent with 
the requirements indicated in Section 2 may be chosen as indicated in Fig. 22. 
Thus, in order that the network N’ correspond to the high-side equivalent 
circuit of the coupling transformer and, at the same time, have a final 
capacitance C,,, the least number of elements which may be chosen in a 
practical design is » = 5. The specified elements of Fig. 22 are the parasitic 
terminating capacitance Cs and the effective impedance oi the line, R, .* 


23 See footnote 4. 
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Practical values for these elements may be chosen as Cs = 20 wf and R; = 
150 ohms. 
Next, the transfer specifications for this illustration may be summarized as 
(a) Degree of equalization—k = 0.25 
(b) Useful band—2.5 to 8.0 mc 
(c) Useful band distortion—< +0.10 db 
(d) Resistance efficiency—65°% 


f 
d 


The computation of the desired transfer characteristic Ae’’” begins with 
the consideration of the degree of equalization. In order to equalize one- 
quarter of the power loss between coaxial repeaters, the transfer character- 
istic over the useful band must vary as Ke" ~ where a’ represents the com- 
plete line loss between repeaters. If it is assumed that @’ is 4 nepers (34.7 db)*4 
at 8.0 me (« = 1) and varies asa’ = f(x) = 4./x, the transfer character- 
istic over the range, 0 < x < 1, according to eq. (10), becomes 


Ket = gp agl-v2) _ oo V2) 
where a = kf(x) = Wx andag = &f(1) = 1. 

The specification of a useful band from 2.5 to 8.0 mc (or x = 0.3 to 
x = 1.0) in this example is chosen to illustrate the practical limitation on 
the precision of equalization at low frequencies. The dashed curve of Fig. 23 
indicates a low-frequency response which seems realistic for this illustration. 

The computation of the desired transfer characteristic is completed when 
the out-band portion of the characteristic is chosen to satisfy the specified 
resistance efficiency. The assumption of a linear cut-off characteristic is 
suitable as an initial requirement. Hence, the transfer characteristic may be 
summarized as shown in Fig. 23. The solid curve of this figure represents the 
transfer characteristic which would be required for equalization over the 
range, 0 < x < 1, while the dashed curve indicates the modification in this 
curve resulting from the choice of a conservative low-frequency response 
and the specification of a useful band of 0.3 < x < 1. 

The solution of the approximation problem consists of three main oper- 
ations. First, is the determination of the amplitude function a(g) from the 
transfer characteristic specified in Fig. 23. Second, is the determination of 
the Fourier cosine coefficients, dp --+ ad, , of the approximating function 
filg) and the calculation of the coefficients, Ao --- An, of f(x*). Third, is 
the choice of the coefficient €? of the squared Tchebycheff polynomial. 

The amplitude function a(¢g) is calculated from the specified transfer 
characteristic by using the relations expressed by eq. (22)’. According to 
eq. (11) of Section 3, the specification for B(x?) over the useful band, 


24This discrimination is correct for 4 or 5 miles of coaxial cable. The attenuation on a 
coaxial line varies as the square root of frequency, 
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Fig. 23—Transfer characteristic for the network of Fig. 22. The dashed curve indicates the 
modification which results from the choice of a conservative low-frequency response 


TABLE II 
RESULTS OF CALCULATIONS IN THE x DOMAIN AND IN THE ¢ DOMAIN 





x | B(x? f(x? | ¢ Big) B(y) cos’ 5 fily fle 
Ponti § | < 
0 | 3.00 2.98 0° 3.00 3.00 2.98 2.98 
0.1 1.07 2.91 10 2.88 2.80 2.77 2.87 
0.2 2.69 2.74} 20° 2.74 2.49 2.48 2.73 
0.3 2.49 2.48 | 30° 2.56 2.09 2.09 2.57 
0.4 2.09 2.17 40° 2.21 1.54 1.58 2.28 
0.5 1.80 1.85 50 1.87 1.05 1.07 1.95 
0.6 1.57 1.57 | 60° 1.60 0.68 0.70 1.65 
oF | 18 1.39} 70° 1.37 0.42 0.43 1.39 
0.8 1.22 1.23 | 80° 1.17 0.24 0.24 1.17 
0.9 1.11 1.13) 90° 1.00 0.13 0.13 1.00 
1.0 1.00 1.00 | 
1.1 — | 0.56 
1.2 — | —0.32 
1.3 — —2.12 | 
1.5 - | —11.4 
2.0 —115.0 | 
0.3 < x < 1, becomes 
B(x’) = Pe MO = PA-v2) 


In addition, the specification for B(x?) may be extended to zero frequency 
by reciprocating the dashed portion of the curve of Fig. 23 in the range 
O<« < 0.3. 
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° ° ° . a ef _ 9 2 4 5 
In this illustration a simplified f(a?) = Ap + Ay + Aox” + Agr” of 
order (7 — 2) may be chosen such that the transfer characteristic is matched 
within the specified tolerance over the useful band.* The specification a‘) 
is determined from B(x?) by (1) calculating the B(g) which corresponds to 


n 


B(x*) in the g domain, and (2) multiplying Big) by cos” = to obtain alg) = 


bdRo16 


se me . : . . ‘ . 
Big) cos” coe he results of these calculations in the g domain are indicated 


~ 


by the fifth and sixth columns of Table II. 

The Fourier cosine coefficients, do --- a, , are found by solving the set of 
; or (a 
linear equations expressed by eq. (25) for n = 3 ands = * Phe C, which 


depend on the approximated function a(¢g) are computed from eq. (26). 
After the indicated graphical integration is carried out, these constants have 
the following values in this illustration: 


Co = 2.323 
C; = 1.964 
C, = 1.148 
C3 = 0.452 


The matrix [P| for n = 3 according to eq. (27) is 








- 7 
; er 
wr i 0 
4 3 
[Pix] = : 
0 1 3 
Ss 3 
Co. ee 
= -_ oe 


The existence of a solution of eq. (28) depends on Pj, | ¥ 0. In this case 
this determinant becomes 
Px.) & 0.00009. 
Thus, for all practical purposes, the linear equations for n = 3 represent a 
dependent set. However, when Po) = { is substituted for 3 above,” the 
* For the value of the tolerance specified in this illustration, an f(x?) of order 3 turns 
out to be satisfactory. In the general case, where a higher degree of precision is desired, 


it is, of course, expedient to choose an f(x?) of order 1. 
6 See discussion on p. 742. 


aes 














DESIGN OF REACTIVE EQUALIZERS 747 


solution for the a; according to eq. (29) is 


we 123 2.117: —1.166: 0.350 


ay 2.117 | —1.273 | —0.350: 1.166 2.323 | 0.016 | 
a, | _ 1.964 | _ 2.527 
az — 1.166: —0.350 4.320} —3.798 1.148 —().150 
a3 ; 10.452 ;. 0.698 


0.350: — 1.166 | — 3.798 4.320 








As previously stated, these coefficients represent the practical minimum 


. @ 
of the average error in the mean-square sense over the range 0) to 5 in the gy 


domain. However, they do not represent the best match over the useful band 
for this illustration. The adjustment of these coefficients to produce a more 
satisfactory match at high frequencies in the usei.! band begins by changing 


the value of a) to make f; ( ) = dy — a2 = 0.125. This condition is satisfied 


2 


when the general level of response is lowered su that a) = —0.025. The only 


further adjustment that is necessary in order to compensate for the de- 
3 


creased tolerance of f,(g) = }<a; cos jy at high frequencies in the useful band 
?7=0 


is a change in the value of a3. When a; is adjusted to a; = 0.623 a suitable 
approximating function for a(g) in this illustration is 


fig) = x a; cos jg = —0.025 + 2.527 cose 


7=0 


— 0.150 cos 2¢ + 0.623 cos 3¢. 


Hence, the approximating function for Bg) is 


f(e) fly)  —0.025 + 2.527 cos ¢ — 0.150 cos 2g + 0.623 cos 3¢ 
¢ =. = - 
. Tolg) eer A 

Cos J 


These functions are tabulated in the last two columns of Table II. 

The coefficients Ao --- Az of f(x?) are easily calculated from the /fi(¢) 
and f(g) above by the relation of the 1, to the a; expressed in Table I. Thus, 
is — » ~ 4 »>-.6 
f(x?) = 2.975 — 6.143x7 + 7.493x° — 3.325x. 

The final operation in the solution of the approximation problem is the 
choice of the squared Tchebycheff polynomial, €°V,(x), which satisfies a 
resistance efficiency of 65 per cent. The Tchebycheff polynomial for n = 5 is 


Vi(x) = 5x — 20x" + 162°. 
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Thus, V3(*) becomes 
Vi(x) = 25x° — 200x* + 560x° — 640x° + 256x"". 
A e& = 0.01 is easily found such that the resistance efficiency calculated 


from a graphical integration of fi’) + €V2(x) equals 63 per cent. Hence, 
Z2( 7X) F 
Ry 
1 . 1 
f(a?) + EO Vi(x) ~ (2.975 — 6.143%" + 7.493x* — 3.325x°) 
+ (0.25x" — 2.00x* + 5.60x° — 6.40x8 + 2.56x"") 


the analytical expression for K becomes 

















18) it 1 1 1 L a | M 1 1 l it l 1 i 
1¢) 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 
WwW _ 
w= * 


Fig. 24—Comparison of the resultant special transfer function with the transfer 
characteristic of Fig. 23. 


This expression is the resultant special transfer function which satis- 
factorily approximates the transfer characteristic of Fig. 23. Fig. 24 shows a 
plot of these functions for comparison purposes. 

The squared magnitude of the transfer impedance of the network V’ is 
found from the analytical expression for the special transfer function by 
adjusting the value of K so that KA» = 1. Therefore, 


| Zi2( jx) ’ ; 1 


aa 2 4) nwmee.8 7467.8 10+ 
Ry 1 — 1.981a° + 1.846x° + 0.765x° — 2.157x° + 0.861% 
rp ° yf . 
rhe elements of the network V are found from the squared magnitude 
of the transfer impedance by methods standard in circuit theory.” The 
network elements of Fig. 22 in terms of unit impedance and unit radian 


Ref, 2; pp. 25-53. 




















DESIGN OF REACTIVE EQUALIZERS 749 


frequency turn out to be 
C, = 0.470 farads L, = 1.250 henrys 
C; = 1.201 farads Ls = 2.220 henrys. 
Cs = 0.594 farads 
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Fig. 25--Computed gain characteristic of the input coupling circuit of Fig. 22. 


Ry is calculated from the equation which relates to normalized value of C; 


i above to wo and the actual value of C; = 20 X 10~' farads. Thus 
fit , 

0.594 ‘ 

; = 20 X 10-?* farads, 

tid Ro wo 


and Ry = 591 ohms. 
The actual values of the network elements of Fig. 22 are found as 
Ci = 15.8 buf Lo = 14.7 mh 
j C3 = 40.5 uyf L4 = 26.2 mh, 
Cs = 20.0 upf 











~ 
Z 


BELL SYSTEM TECHNICAL JOURNAL 


and the step-up turns ratio, a, of the ideal transformer is 


a= Vx =. 1 9e, 


These values then represent the input coupling network which theoreti- 
cally equalizes to the specified degree of precision one-quarter of the power 
loss between coaxial repeaters over a frequency band from 2.5 to 8.0 mc. 
The computed gain characteristic of this network is plotted in Fig. 25, 
Curve I. The presence of the ideal transformer represents an added constant 


_—* : eo. _— 
gain, Curve II, given by db = 10 log Ps = 5,96. The total gain inserted by 
L 


the network, the sum of Curves I and II, is db = 10 log el = 10log m4. 5.96. 
Ri Ry 

Since Curve III represents one-quarter of the power loss between repeaters, 

Curve IV is the overall transmission gain of the line and equalizer.* The 

deviation of Curve IV from a constant transmission over the useful band 

is less than +0.08 db. It may be concluded, then, that a satisfactory non- 

dissipative design has been obtained. 
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Abstracts of Technical Articles by Bell System Authors 


Testing Cathode Materials in Factory Production.| J. T. ACKER. The paper 
deals with the methods of testing radio-tube cathode materials in factory 
production, and especially with a comparison of several specific lots of 
materials of variable content. It is believed that this is the first time the 
electron-tube industry has made mass tests on a well-controlled engineering 
basis of cathode materials which vary in single component elements. 

Advances in the Theory of Ferromagnetism2 KR. M. Bozortu. This article 
presents the results of the most recent investigations in the field of ferro- 
magnetism. There have been a number of new ideas brought forth through 
research along these lines, of which three of the most outstanding ones are 
explained and illustrated. 

On Magnetic Remanence® RK. M. Bozortu. The magnetic retentivity of 
many materials is about half of the magnetization at saturation, a fact ac- 
counted for by simple domain theory. In some materials, however, the re- 
tentivity is only a small fraction of saturation, sometimes less than 10 per 
cent. The explanation of this fact is discussed. It is suggested that in mate- 
rials with almost zero magnetic anisotropy the Bloch walls between domains 
increase in thickness until they envelop the whole specimen and the domain 
structure disappears. 

Multifrequency Pulsing in Switching.’ C. A. DauLtBom, A. W. Horton, 
Jk., and D. L. Moopy. Applications of multifrequency pulsing in switching 
are described in this article. Today, many installations of this type are 
being made in cities throughout the nation. This system permits operators 
or senders to complete calls to crossbar offices without the aid of other 
operators. 

Circuits for Cold Cathode Glow Tubes.’ W. A. Depe and W. H. T. HoLpen, 
This paper discusses fundamental operating characteristics and typical cir- 
cuits using cold cathode glow tubes for relays, impulse generators, pulse 
counting and interlocking functions. 

The Substitution Method of Measuring the Open Circuit Voltage Generated 
by a Microphone.’ M.S. Haw ry. An analysis of the substitution method 
of measuring the open circuit voltage generated by a microphone is given 

1 Proc. 1.R.E.—W aves and Electrons Section, v. 37, pp. 688-690, June 1949 

2 Elec. Engg., v. 68, pp. 471-476, June 1949. 

3 Zeits. f. Physik, v. 124, 7/12, pp. 519-527, 1948 

' Elec. Engg., v. 68, pp. 505-510, June 1949 


5 Elec. Mfg., v. 44, pp. 92-97, July 1949. 
§ Jour. Acous. Soc. Amer., v. 21, pp. 183-189, May 1949. 
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which shows that the ‘“‘normal” substitution voltage equals the open circuit 
voltage for all types of acoustic measurements and for any value of electric 
impedance loading the microphone. It is shown that the method recently 
proposed by some authors of removing the acoustic load from the micro- 
phone when applying the substitution voltage results in a substitution volt- 
age which does not equal the open circuit voltage. It is also shown that a 
formula for the response of a transducer derived for a system in which the 
microphones are open-circuited may be used when the microphones are 
terminated by finite electrical impedances, by replacing the generated open 
circuit voltages in the formula by the corresponding “normal” substitution 
voltages. 

Consideration is given to the restriction in the definition of the pressure 
response of a transducer made necessary by the fact that the pressure on a 
microphone diaphragm is a function of the electrical impedance terminating 
the microphone. 

An experiment is described which involves a microphone coupled to a 
chamber, the acoustical impedance of which is high relative to that of the 
microphone. The results of this experiment agree with the conclusions of the 
analysis. 

A Note on Filler-Type Traveling-Wave Amplifiers.’ J. R. Prerce* and 
NELSON Wax. A small-signal analysis of systems in which an electron beam 
interacts with a circuit composed of discrete filter elements is given here. 
The effects of a line beam interacting with a series of gaps, which are capaci- 
tive elements of a filter structure, are calculated, and it is shown that an 
admittance can be introduced which arises from the presence of the elec- 
trons. This admittance is in parallel with the gap capacitance, and thus 
will alter the propagation factor of the filter circuit. It is shown that travel- 
ing-wave solutions exist for the combination of electron beam and filter 
circuit, and that there is a solution which has a positive real part, indicating 
that gain will be exhibited. 


7 Proc. I.R.E., v. 37, pp. 622-625, June 1949. 
*Of Bell Tel. Labs. 
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RESOLUTION CHART 
































100 MILLIMETERS 


INSTRUCTIONS Resolution is expressed in terms of the lines per millimeter recorded by a particular 
film under specified conditions. Numerals in chart indicate the numbeg of lines per millimeter in adjacent 
“T-shaped” groupings. 

In microfilming, it is necessary to determine the reduction ratio and multiply the number of lines in the 
chart by this value to find the number of lines recorded by the film. As an aid in determining the reduction 
ratio, the line above is 100 millimeters in length. Measuring this line in the film image and dividing the length 
into 100 gives the reduction ratio. Example: the line is 20 mm. long in the film image, and 100/20 = 5. 


Examine “T-shaped” line groupings in the film with microscope, and note the number adjacent to finest 
lines recorded sharply and distinctly. Multiply this number by the reduction factor to obtain resolving power 
in lines per millimeter. Example: 7.9 group of lines is clearly recorded while lines in the 10.0 group are 
not distinctly separated. Reduction ratio is 5, and 7.9 x 5 = 39.5 lines per millimeter recorded satisfacto- 
rily. 10.0 x 5 = $0 lines per millimeter which are not recorded satisfactorily. Under the particular condi- 
tions, maximum resolution is between 39.5 and 50 lines per millimeter. 


Resolution, as measured on the film, is a test of the entire photographic system, including lens, exposure, 


processing, and other factors. These rarely utilize maximum resolution of the film. Vibrations during 
exposure, lack of critical focus, and exposures yielding very dense negatives are to be avoided. 
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